CVE-2026-8443— Josh White WP Review Slider Pro SQL注入漏洞

WP Review Slider Pro <= 12.6.8 - Authenticated (Subscriber+) SQL Injection via 'stypes' Parameter

The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'stypes' and 'slocations' parameters of the wppro_get_overall_chart_data AJAX action in versions up to, and including, 12.6.8. This is due to the use of stripslashes() on user-supplied JSON strings prior to json_decode(), which removes the escaping applied by WordPress's wp_magic_quotes; the resulting decoded array values are then concatenated directly into SQL WHERE clauses without parameterization, and the constructed query is executed via $wpdb->get_results() without $wpdb->prepare(). This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The handler also returns the executed SQL string in its JSON response, which simplifies oracle construction for blind exploitation.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SQL命令中使用的特殊元素转义处理不恰当(SQL注入)

Josh White WP Review Slider Pro SQL注入漏洞

Josh White WP Review Slider Pro是Josh White个人开发者的一个通过幻灯片展示用户评价的WordPress插件。 Josh White WP Review Slider Pro 12.6.8及之前版本存在SQL注入漏洞，该漏洞源于对用户提供的JSON字符串使用stripslashes()函数后将其解码并直接拼接至SQL WHERE子句中，未使用参数化查询，可能导致已认证的攻击者（Subscriber级别及以上）向已有查询中添加额外的SQL查询以提取数据库中的敏感信息。

N/A

N/A