PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-8443 https://wpreviewslider.com/ CVE debrief

The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'stypes' and 'slocations' parameters of the wppro_get_overall_chart_data AJAX action in versions up to, and including, 12.6.8. This is due to the use of stripslashes() on user-supplied JSON strings prior to json_decode(), which removes the escaping applied by WordPress's wp_magic_quotes; the resulting decoded array values are then concatenated directly into SQL WHERE clauses without parameterization, and the constructed query is executed via $wpdb->get_results() without $wpdb->prepare(). This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The handler also returns the executed SQL string in its JSON response, which simplifies oracle construction for blind exploitation.

Vendor
https://wpreviewslider.com/
Product
WP Review Slider Pro
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-16
Original CVE updated
2026-06-16
Advisory published
2026-06-16
Advisory updated
2026-06-16

Who should care

Users of the WP Review Slider Pro plugin for WordPress, particularly those with Subscriber-level access and above, should be aware of this vulnerability and take steps to mitigate it.

Technical summary

The vulnerability exists in the wppro_get_overall_chart_data AJAX action of the WP Review Slider Pro plugin. An authenticated attacker can inject malicious SQL queries by manipulating the 'stypes' and 'slocations' parameters. The vulnerability is caused by improper handling of user-supplied JSON strings, which allows attackers to execute arbitrary SQL queries.

Defensive priority

High

Recommended defensive actions

  • Update the WP Review Slider Pro plugin to a version that is not vulnerable.
  • Limit access to the wppro_get_overall_chart_data AJAX action to prevent unauthorized users from exploiting the vulnerability.
  • Monitor database activity for suspicious queries.

Evidence notes

The CVE record and NVD detail provide evidence of the vulnerability and its impact.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-8443 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-8443

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-8443 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-8443

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.