CVE-2026-8443 Details
Description
The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'stypes' and 'slocations' parameters of the wppro_get_overall_chart_data AJAX action in versions up to, and including, 12.6.8. This is due to the use of stripslashes() on user-supplied JSON strings prior to json_decode(), which removes the escaping applied by WordPress's wp_magic_quotes; the resulting decoded array values are then concatenated directly into SQL WHERE clauses without parameterization, and the constructed query is executed via $wpdb->get_results() without $wpdb->prepare(). This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The handler also returns the executed SQL string in its JSON response, which simplifies oracle construction for blind exploitation.
A SQL injection vulnerability has been identified in the WP Review Slider Pro plugin for WordPress, affecting versions through 12.6.8. The issue arises in the wppro_get_overall_chart_data AJAX action, where the 'stypes' and 'slocations' parameters are vulnerable. The vulnerability is caused by the improper handling of user-supplied JSON strings, which are stripped of their escaping before being decoded. This allows the resulting array values to be directly concatenated into SQL WHERE clauses without proper parameterization. The executed SQL query is then returned in the JSON response, facilitating blind exploitation. Authenticated attackers with Subscriber-level access and above can exploit this vulnerability to inject additional SQL queries into existing ones, potentially leading to the extraction of sensitive information from the database.
Users are advised to update the WP Review Slider Pro plugin to version 12.7.0 or a newer patched version.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 16, 2026CISA-ADP
Assessed Jun 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://wpreviewslider.com/ | [email protected] | ProductVendor |
| https://www.wordfence.com/threat-intel/vulnerabilities/id/1055bba0-7dbd-4382-afaf-ecea442c527c?source=cve | [email protected] | AdvisoryBundleRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| WP Review Slider Pro | <= 12.6.8 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 16, 2026 | New CVE Received | [email protected] |