CVE-2026-66658

The Reviewer plugin for WordPress contains a vulnerability that allows attackers with subscriber-level access or higher to inject malicious SQL code into the database. This occurs because the plugin does not properly sanitize user input, allowing attackers to modify existing SQL queries and potentially extract sensitive information. As a result, authenticated attackers can exploit this vulnerability to extract sensitive data from the database.

Based on public CVE data (MITRE/NVD).