CVE-2026-66658

HighCVSS 8.5

Published: 13/08/2026(UTC)Updated: 24/10/2026(UTC)Translated: 13/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.36%

29th percentile - higher than 29% of all known CVEs

Summary

The Reviewer plugin version 3.14.2 and earlier contains a SQL Injection vulnerability for users with the subscriber role. A user with low privileges can execute malicious SQL queries against the database.

Risk Assessment

The risk includes unauthorized access to database data, modification or deletion of data, and potential takeover of administrator accounts. This could lead to compromise of data confidentiality and integrity.

Recommendation

It is recommended to update the Reviewer plugin to a version newer than 3.14.2. Also, use prepared statements and input validation.

Other vulnerabilities in Reviewer

CVE-2026-65479Medium
The Reviewer plugin versions up to 3.14.2 contain a subscriber broken access control vulnerability. An attacker with subscriber privileges can bypass access control mechanisms.

Original NVD description (English source)

Subscriber SQL Injection in Reviewer <= 3.14.2 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS