Slider Hero EUVD-2026-59902

Exploitation requires a valid WordPress administrator-level account (or higher, such as Super Admin in multisite) on the target installation - this is confirmed by CVSS PR:H. The attacker must additionally have the ability to create or edit slides within the Slider Hero plugin interface, and must trigger the heroduplicateslider AJAX action to cause the second-order injection to fire; simply saving malicious slide data is insufficient on its own. The Slider Hero plugin must be installed and active. Limiting factors include the mandatory high-privilege account requirement, the two-step nature of the attack (write then duplicate), and the absence of any integrity or availability impact - exploitation is read-only database exfiltration only. There is no evidence of a default WordPress configuration that would expose this attack surface to unauthenticated users.

The CVSS 3.1 score of 4.9 (Medium) with vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N accurately reflects the constrained threat model: network-accessible but requiring high-privilege (administrator) credentials, with impact limited to confidentiality (read-only SQL injection, no write or denial-of-service). No EPSS score was supplied in the intelligence data, and this CVE does not appear in the CISA Known Exploited Vulnerabilities catalog, meaning exploitation in the wild is not confirmed. The absence of a public proof-of-concept further suppresses the urgency for most organizations. That said, even a mid-sized municipal IT team in ustka running a multi-tenant WordPress environment - where administrator accounts are delegated broadly across departments - should treat this as a meaningful risk, since a compromised or malicious admin account could silently harvest credential hashes, API keys, or personally identifiable information stored in the database. The second-order pattern also increases detection difficulty, as the malicious payload is injected in a benign-looking write operation and detonated later during a routine administrative task.

An attacker with WordPress administrator credentials navigates to the Slider Hero management interface and creates or edits a slide, injecting a SQL payload (e.g., a UNION SELECT or stacked query extracting wp_users credential hashes) into a slide field such as the description or custom field - these are safely stored by $wpdb->update(). The attacker then triggers the 'Duplicate Slider' action, which causes qcld_sliderhero_duplicate() to re-read the stored payload as a raw string and concatenate it into an INSERT query executed without sanitization, achieving SQL injection and exfiltrating database contents. No public proof-of-concept has been identified at time of analysis, but the Trac source references make the vulnerable code path directly auditable.