CVE-2026-8443

WP Review Slider Pro <= 12.6.8 - Authenticated (Subscriber+) SQL Injection via 'stypes' Parameter

Published Jun 16, 2026 CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Description

The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'stypes' and 'slocations' parameters of the wppro_get_overall_chart_data AJAX action in versions up to, and including, 12.6.8. This is due to the use of stripslashes() on user-supplied JSON strings prior to json_decode(), which removes the escaping applied by WordPress's wp_magic_quotes; the resulting decoded array values are then concatenated directly into SQL WHERE clauses without parameterization, and the constructed query is executed via $wpdb->get_results() without $wpdb->prepare(). This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The handler also returns the executed SQL string in its JSON response, which simplifies oracle construction for blind exploitation.

Analysis

Technical impact

The WP Review Slider Pro plugin contains an SQL Injection flaw in the 'stypes' and 'slocations' parameters of the wppro_get_overall_chart_data AJAX action. The code removes JSON escaping through stripslashes() before decoding, then inserts unvalidated data directly into SQL WHERE clauses. This allows an authenticated user with Subscriber privilege or higher to inject additional SQL statements and extract sensitive database content. The handler also echoes the constructed SQL in its JSON response, simplifying blind exploitation and increasing the risk of data leakage.

Affected Systems

WP Review Slider Pro for WordPress, all releases up to and including version 12.6.8 are affected. No other vendors or products are listed.

Risk and Exploitability

The vulnerability has a CVSS score of 8.8, indicating high severity, but the EPSS score is below 1%, meaning exploit attempts are currently rare. It is not listed in CISA’s KEV catalog. The attack vector is inferred to be an authenticated AJAX request, requiring at least Subscriber‑level access. While the high CVSS reflects significant confidentiality risk, the low EPSS suggests limited real‑world exploitation at this time.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

https://wpreviewslider.com/

WP Review Slider Pro

unaffected

Version	Status	Constraints
`0`	affected	≤ 12.6.8

No data.

Vendor Product Versions

Wordpress

Version	Status	Scheme	Platform
`—`	unaffected	—	—

Wpreviewslider

Wp Review Slider Pro

Version	Status	Scheme	Platform
`[0,12.6.8]`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade WP Review Slider Pro to the latest release (12.6.9 or newer) to eliminate the injection flaw.
If an update is not immediately possible, disable the wppro_get_overall_chart_data AJAX endpoint or remove the plugin from the live site until the patch is applied.
Restrict Subscriber‑level accounts or temporarily lower their privileges until the vulnerability is remediated to prevent exploitation.

Generated by OpenCVE AI on June 17, 2026 at 22:48 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.335% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://wpreviewslider.com/
https://www.wordfence.com/threat-intel/vulnerabilities/id/1055bba0-7dbd-4382-afaf-ecea442c527c?source=cve

History

Jun 23, 2026 9:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Wordpress Wordpress wordpress Wpreviewslider Wpreviewslider wp Review Slider Pro
Vendors & Products		Wordpress Wordpress wordpress Wpreviewslider Wpreviewslider wp Review Slider Pro

Jun 16, 2026 6:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Jun 16, 2026 6:30 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'stypes' and 'slocations' parameters of the wppro_get_overall_chart_data AJAX action in versions up to, and including, 12.6.8. This is due to the use of stripslashes() on user-supplied JSON strings prior to json_decode(), which removes the escaping applied by WordPress's wp_magic_quotes; the resulting decoded array values are then concatenated directly into SQL WHERE clauses without parameterization, and the constructed query is executed via $wpdb->get_results() without $wpdb->prepare(). This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The handler also returns the executed SQL string in its JSON response, which simplifies oracle construction for blind exploitation.
Title		WP Review Slider Pro <= 12.6.8 - Authenticated (Subscriber+) SQL Injection via 'stypes' Parameter
Weaknesses		CWE-89
References		https://wpreviewslider.com/ https://www.wordfence.com/threat-intel/vulnerabilities/id/1055bba0-7dbd-4382-afaf-ecea442c527c?source=cve
Metrics		cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`