CVE-2026-66658

HighCVSS 8.5

Published: 13/08/2026(UTC)Updated: 14/08/2026(UTC)Translated: 13/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.34%

27th percentile - higher than 27% of all known CVEs

Summary

The Reviewer plugin version 3.14.2 and earlier contains a SQL Injection vulnerability for users with the subscriber role. A user with low privileges can execute malicious SQL queries against the database.

Risk Assessment

The risk includes unauthorized access to database data, modification or deletion of data, and potential takeover of administrator accounts. This could lead to compromise of data confidentiality and integrity.

Recommendation

It is recommended to update the Reviewer plugin to a version newer than 3.14.2. Also, use prepared statements and input validation.

Original NVD description (English source)

Subscriber SQL Injection in Reviewer <= 3.14.2 versions.