CVE-2026-66658

The subscriber role is the analytical pivot here. In WordPress, a subscriber is the lowest-privilege authenticated user—someone who can log in and that's essentially it. They cannot publish, edit posts, or access backend functions. The fact that this SQL injection is reachable by subscribers means every registered account on an affected site represents a potential exploitation vector, including abandoned accounts, bot-registered accounts, and single-use registrations that may have stale security attributes. This isn't merely a missing capability check—it reveals a fundamental architectural misjudgment where "low privilege" was conflated with "low access to query execution." The patch will tell you whether you're looking at a straightforward capability gate or a deeper trust-delegation issue. If it's just a capability check added post-hoc, treat the assurance level with skepticism: subscriber-role SQL injection has recurred across WordPress plugins in a cyclical pattern tied to WordPress core release waves, and historical evidence suggests simple capability gates in this context have a half-life problem—they get bypassed or regress. The blast radius extends beyond data extraction. The Reviewer plugin renders on public pages, meaning compromised queries can inject XSS payloads distributing to every visitor—a categorical shift from data breach to active threat infrastructure. Combined with the review data itself (names, emails, behavioral preferences), this creates compound risk: PII suitable for spear-phishing or commercial resale, delivered through a distribution mechanism. Assume compromise rather than mere exposure. The 3.14.2 version number suggests either a long-dormant flaw or a mature plugin attracting automated exploitation chains. Both the detection window and the patch architecture warrant close scrutiny—the former determines how long defenders may have been blind, the latter determines whether you're fixing a symptom or an architectural root cause.

Reviewed through automated stages and approved by a human before publication.