CVE-2026-8443: WP Review Slider Pro SQL Injection – Authenticated Data Extraction

Technical summary

CVE-2026-8443 is a SQL injection vulnerability in WP Review Slider Pro up to version 12.6.8, affecting the wppro_get_overall_chart_data AJAX action. The flaw occurs because the handler processes the 'stypes' and 'slocations' parameters by calling stripslashes() on JSON-encoded input before json_decode(), which defeats WordPress's wp_magic_quotes escaping mechanism. The resulting decoded values are then directly concatenated into SQL WHERE clauses and executed via $wpdb->get_results() without using $wpdb->prepare() for parameterized queries. The response includes the executed SQL string, enabling oracle-based exploitation techniques for blind SQL injection scenarios.

Business impact

A compromised WordPress site running this plugin exposes significant risk to data theft. Attackers with subscriber-level access—a commonly granted permission tier—can extract customer data, user credentials, payment information, or any other content stored in the WordPress database without triggering traditional intrusion alerts. This is particularly damaging for e-commerce sites, membership platforms, and services handling sensitive customer information. The presence of SQL queries in API responses also provides attackers with detailed debugging information, reducing the technical barrier to successful exploitation.

Affected systems

WP Review Slider Pro versions through 12.6.8 are vulnerable. The plugin is installed on WordPress sites, making any WordPress deployment running an affected version at risk. The vulnerability requires authenticated access at the subscriber level or higher, meaning it is exploitable by any user with a login account, including those who may have gained credentials through separate compromises or social engineering. WordPress installations allowing user registration are at higher risk.

Exploitability

This vulnerability is highly exploitable in practical scenarios. The attack requires only network access and valid subscriber-level credentials, both of which are commonly available in WordPress environments. The inclusion of executed SQL strings in JSON responses eliminates the need for sophisticated blind SQL injection techniques; attackers receive direct feedback on query success. No user interaction is required, and the AJAX endpoint is typically accessible to authenticated users without additional complexity. The only limiting factor is the requirement for authenticated access, which is not a significant barrier in most WordPress sites.

Remediation

The primary remediation is to update WP Review Slider Pro to a patched version beyond 12.6.8 (verify the latest safe version against the vendor's official advisory and release notes). No workarounds are available that eliminate the vulnerability. Site administrators should prioritize this patch given the low attack barrier and high potential impact. After patching, review database access logs and user activity for any suspicious queries executed during the time the vulnerable version was active.

Patch guidance

Administrators should verify the latest safe version of WP Review Slider Pro through the official plugin repository or vendor website, then apply the update immediately through WordPress's plugin management interface. Before patching, take a full database backup in case forensic investigation is needed. Test the update in a staging environment if the site is mission-critical. After updating, confirm that the plugin is functioning normally and monitor for any database performance anomalies that might indicate previous exploitation attempts.

Detection guidance

Hunt for exploitation by examining database query logs for unusual SQL patterns in conjunction with wppro_get_overall_chart_data AJAX requests, particularly those containing UNION, SELECT, or comment sequences in the 'stypes' or 'slocations' parameters. Review access logs for POST requests to /wp-admin/admin-ajax.php with action=wppro_get_overall_chart_data originating from low-privilege user accounts. Monitor for sudden bulk data downloads or database queries targeting user tables, payment information, or wp_users. Web application firewalls configured with SQL injection detection rules should flag these requests if logging is enabled. Check plugin versions across all WordPress installations to identify vulnerable deployments.

Why prioritize this

This vulnerability merits immediate patching priority due to its combination of high CVSS score (8.8), low attack complexity, low privilege barrier, and direct data exfiltration capability. The presence of executed SQL in responses significantly lowers the skill required to exploit it. Any WordPress site running this plugin with open user registration or multiple staff accounts is at elevated risk. The plugin's review and charting functionality is often enabled on public-facing sites, increasing exposure.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) reflects a network-accessible vulnerability requiring only low-privilege authenticated access with no user interaction, resulting in high impact across confidentiality, integrity, and availability. The score appropriately weights the ease of exploitation and the severity of potential data loss, though organizations should treat this as critical in their internal risk rankings given how commonly WordPress plugins are exposed and how prevalent subscriber-level access is in WordPress environments.

Frequently asked questions