The Slider Hero WordPress plugin contains a second‑order SQL injection flaw that is triggered when an administrator runs the "heroduplicateslider" task. The duplicate function rewrites slide data by concatenating raw values into an INSERT query without using a prepared statement, allowing an attacker with administrator privileges to inject arbitrary SQL. The vulnerability is a classic CWE‑89 situation that enables extraction of sensitive database information, potentially including user credentials and site configuration data.

The affected product is the Slider Hero with Video Background, Animation plugin from QuantumCloud. Versions up to and including 9.1.7 are vulnerable. The flaw exists in the qcld_sliderhero_duplicate() function and is present in the WordPress plugin code at the listed source locations.

The CVSS score of 4.9 indicates moderate severity, but the attack requires authenticated administrator access and a specific action (duplicate slider) that may not be routinely performed, limiting ease of exploitation. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, suggesting no known large‑scale public exploitation yet. However, once an admin triggers the duplicate task, the injected SQL can read arbitrary data, so organizations should treat this as a moderate to high risk if they run the vulnerable plugin version.