CVE-2026-8443

Name of the Vulnerable Software and Affected Versions WP Review Slider Pro versions prior to 12.6.9

Description Authenticated attackers with Subscriber-level access and above can perform SQL Injection through the 'stypes' and 'slocations' parameters of the 'wppro get overall chart data' AJAX action. The issue occurs because stripslashes() is used on user-supplied JSON strings before json decode(), removing the escaping provided by wp magic quotes. The decoded values are then concatenated directly into SQL WHERE clauses and executed via $wpdb->get results() without using $wpdb->prepare(), which is the standard method for parameterizing queries to prevent injection. This allows attackers to append malicious SQL queries to extract sensitive database information. Additionally, the handler returns the executed SQL string in its JSON response, facilitating blind exploitation by simplifying oracle construction (a technique used to infer data by observing the application's response to specific queries).

Recommendations Update to a version later than 12.6.8. As a temporary workaround, restrict access to the 'wppro get overall chart data' AJAX action for users with Subscriber-level permissions.