An authenticated SQL injection vulnerability in the WP Google Review Slider plugin could allow an administrator to execute unauthorized database queries, leading to potential data exposure.

The plugin fails to adequately sanitize input, permitting SQL injection. The attack requires high-level privileges, as indicated by the CVSS PR:H vector, limiting the exploitability to authenticated administrators.

With a CVSS score of 7.6, this vulnerability poses a serious threat to the integrity of the WordPress database. While the requirement for administrative access narrows the attacker pool, a compromised administrator account could result in unauthorized data exfiltration or site-wide disruption.

Immediate Action: Update the WP Google Review Slider plugin to version 18.5 or later.

Proactive Monitoring: Audit administrative user activity and monitor database logs for suspicious queries originating from the plugin backend.

Compensating Controls: Utilize a Web Application Firewall to block requests containing malicious SQL fragments and strictly limit administrative access to the WordPress dashboard.

Public Exploit Available: Unknown.

Administrators should apply the 18.5 patch immediately to remediate the vulnerability. Furthermore, organizations should ensure that only trusted individuals hold administrative privileges to minimize the impact of such flaws.