CVE-2023-0260: 
WordPress vulnerability analysis and mitigation

The vulnerability CVE-2023-0260 affects the WP Review Slider WordPress plugin versions below 12.2. This SQL injection vulnerability was discovered and publicly disclosed on January 23, 2023. The vulnerability affects the wp-facebook-reviews plugin and can be exploited by users with privileges as low as subscriber level (WPScan).

The vulnerability stems from improper sanitization and escaping of a parameter before its use in SQL statements. It has been classified as a SQL Injection (SQLI) vulnerability, falling under the OWASP Top 10 category A1: Injection and CWE-89. The vulnerability carries a CVSS score of 7.7 (High), indicating its significant severity (WPScan).

When exploited, this vulnerability could allow authenticated users with subscriber-level access or higher to perform SQL injection attacks against the affected WordPress installation. This could potentially lead to unauthorized access to or manipulation of the database (WPScan).

The vulnerability has been fixed in version 12.2 of the WP Review Slider plugin. Website administrators are strongly advised to update to this version or later to mitigate the risk (WPScan).