EUVD-2026-37037
GHSA-m8xj-3v37-wrp9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconRegister Subscriber account on target
-
DeliveryAuthenticate to /wp-admin/admin-ajax.php
-
ExploitSend crafted JSON in stypes/slocations to wppro_get_overall_chart_data
-
Installstripslashes strips wp_magic_quotes escaping
-
C2Injected SQL concatenated into unprepared WHERE clause
-
ExecuteRead echoed SQL and UNION results from JSON response
-
ImpactExfiltrate user hashes and secrets from wp_users
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires (1) a valid WordPress account at Subscriber role or higher on the target site - practically achievable on any site with open registration enabled - and (2) the WP Review Slider Pro plugin installed and active at version 12.6.8 or earlier with the wppro_get_overall_chart_data AJAX action reachable at /wp-admin/admin-ajax.php. No user interaction by an admin is needed, no specific non-default plugin configuration is required, and the attack is delivered over the network. The principal limiting factor is the authentication barrier: sites that disable self-registration and do not expose Subscriber credentials are not directly exploitable by unauthenticated attackers. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8 High) is well-supported by the description: network-reachable AJAX endpoint, no special complexity, and only a Subscriber account - the default registration role on many WordPress sites - is required. Wordfence is the reporter, which is a strong signal of analyst-grade triage, though no EPSS, KEV, or SSVC values were supplied in the input. The handler's echo of the executed query into the JSON response is a notable amplifier that turns blind SQLi into a near-direct read primitive, so real-world exploitability is meaningfully higher than the base score suggests; conversely, sites that disable open registration ('Anyone can register' off) materially reduce exposure since attackers must first obtain or create a Subscriber account. |
| Exploit ScenarioDerived | An attacker registers (or compromises) a Subscriber account on a target WordPress site, then sends an authenticated POST to /wp-admin/admin-ajax.php invoking the wppro_get_overall_chart_data action with a crafted JSON 'stypes' or 'slocations' payload whose array elements contain a UNION SELECT against wp_users. Because the handler returns the executed SQL string in its JSON response, the attacker observes both their injected query and the result, exfiltrating password hashes and session tokens with a single round-trip - no public exploit identified at time of analysis, but the oracle behavior makes weaponization straightforward. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 16, 2026
SQL injection in the WP Review Slider Pro WordPress plugin (versions ≤12.6.8) allows authenticated attackers with Subscriber-level access to inject arbitrary SQL via the 'stypes' and 'slocations' JSON parameters of the wppro_get_overall_chart_data AJAX action. Because the vulnerable handler echoes the executed SQL back in its JSON response, attackers gain a built-in oracle that turns blind injection into a near-trivial database extraction primitive. No public exploit identified at time of analysis, but the very low privilege barrier on a default WordPress install makes any exposed site a realistic target.
RemediationAI
No vendor-released patch version was provided in the available data, so the immediate action is to consult the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/1055bba0-7dbd-4382-afaf-ecea442c527c?source=cve) and the vendor at https://wpreviewslider.com/ for a release greater than 12.6.8 and upgrade as soon as one is published. As compensating controls until a fixed build is installed: disable open user registration in WordPress (Settings → General, uncheck 'Anyone can register') to remove the Subscriber-account precondition, with the side effect that legitimate self-service signups are blocked; block or rate-limit POST requests to /wp-admin/admin-ajax.php with action=wppro_get_overall_chart_data at a WAF, accepting that any in-product chart features relying on that action will break; and as a last resort deactivate the plugin entirely, which removes the front-end review slider widgets. Audit existing Subscriber accounts and database logs for suspicious SELECTs against wp_users/wp_usermeta and rotate secrets if compromise is suspected.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The plugin's AJAX endpoint accepts JSON-encoded arrays in the 'stypes' and 'slocations' POST parameters. WordPress's wp_magic_quotes automatically backslash-escapes incoming superglobal data, but the handler calls stripslashes() on these strings before passing them to json_decode(), undoing the platform's escaping. The decoded array elements are then concatenated directly into a WHERE clause and executed through $wpdb->get_results() without ever going through $wpdb->prepare() or wpdb::esc_like(), satisfying the classic CWE-89 pattern of tainted data reaching a SQL sink without parameterization. The CPE 'cpe:2.3:a:https://wpreviewslider.com/:wp_review_slider_pro:*' covers all versions up to and including 12.6.8.
Know when Wpreviewslider Com gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable AJAX endpoint (AV:N), no special complexity (AC:L), Subscriber account required (PR:L), no user interaction (UI:N), full DB read/write/destroy via SQLi (C/I/A:H).
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'stypes' and 'slocations' parameters of the wppro_get_overall_chart_data AJAX action in versions up to, and including, 12.6.8. This is due to the use of stripslashes() on user-supplied JSON strings prior to json_decode(), which removes the escaping applied by WordPress's wp_magic_quotes; the resulting decoded array values are then concatenated directly into SQL WHERE clauses without parameterization, and the constructed query is executed via $wpdb->get_results() without $wpdb->prepare(). This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The handler also returns the executed SQL string in its JSON response, which simplifies oracle construction for blind exploitation.
Executive ViewAI
WP Review Slider Pro WordPress plugin (versions ≤12.6.8) contains a SQL injection vulnerability allowing any Subscriber-level user to extract complete database contents through an AJAX endpoint that echoes query results. Organizations using this plugin expose customer data, credentials, and business-critical information to any user with basic account access, with no vendor patch available.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Immediately deactivate and uninstall the vulnerable plugin; (2) Restrict Subscriber role SQL and database query capabilities via WordPress user permission controls; (3) Implement Web Application Firewall rules to block requests to the wppro_get_overall_chart_data AJAX action; (4) Deploy database activity monitoring and alerting on the WordPress database; (5) Enforce strong database credentials, network segmentation, and principle of least privilege for database accounts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
More in Wpreviewslider Com
View allAuthenticated SQL injection in the WP Review Slider Pro WordPress plugin through version 12.6.8 lets Subscriber-level us
Arbitrary file deletion in the WP Review Slider Pro WordPress plugin (versions up to and including 12.6.8) allows authen
SQL injection in the WP Review Slider Pro WordPress plugin (versions up to and including 12.7.2) lets unauthenticated at
Exploit-DB