CVE-2025-26755: 
WordPress vulnerability analysis and mitigation

A SQL Injection vulnerability (CVE-2025-26755) was discovered in the WP Airbnb Review Slider WordPress plugin affecting versions up to and including 3.9. The vulnerability was discovered by Phat RiO - BlueRock and publicly disclosed on February 14, 2025. The issue stems from improper neutralization of special elements used in SQL commands, specifically affecting the plugin's handling of user-supplied parameters (Patchstack, WPScan).

The vulnerability is classified as a SQL Injection (CWE-89) with a CVSS v3.1 base score of 7.6 (High). The attack vector is network-based (AV:N) with low attack complexity (AC:L), requiring high privileges (PR:H), and no user interaction (UI:N). The scope is changed (S:C) with high confidentiality impact (C:H), no integrity impact (I:N), and low availability impact (A:L). The issue arises from insufficient escaping of user-supplied parameters and inadequate preparation of existing SQL queries (NVD, Patchstack).

This vulnerability allows authenticated attackers with administrator-level access to append additional SQL queries to existing ones, potentially leading to the extraction of sensitive information from the database. The high CVSS score reflects the significant potential for data breach, though the impact is somewhat limited by the requirement for administrative privileges (WPScan).

The vulnerability has been fixed in version 4.0 of the WP Airbnb Review Slider plugin. Users are advised to update to version 4.0 or later to remove the vulnerability. Patchstack users can enable auto-update for vulnerable plugins as an additional security measure (Patchstack).