# CVE-2026-8443: WP Review Slider Pro SQL injection in wppro_get_overall_chart_data

Source: https://junglewise.ai/threats/cve-2026-8443-wp-review-slider-pro-sql-injection-in-wppro-get-overall-chart-data  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-16. Updated: 2026-06-16  
License: CC BY 4.0 with a link back

CVE-2026-8443 · Severity: high · CVSS 8.8 · Published 2026-06-16

The WP Review Slider Pro plugin for WordPress, which is used to display customer reviews from various social platforms, contains a security vulnerability that allows logged-in users to interfere with the site's database. By sending specially crafted requests, an attacker with even low-level 'Subscriber' permissions can view sensitive information that they are not authorized to see. This could lead to the exposure of private customer data or site configuration details, potentially compromising the entire website.

Technologies: [WP Review Slider Review Slider](https://junglewise.ai/threats/technologies/review-slider), [WP Review Slider Review Slider Pro](https://junglewise.ai/threats/technologies/review-slider-pro). Vendors: [WP Review Slider](https://junglewise.ai/threats/vendors/wp-review-slider).

## Quick answers

**Is CVE-2026-8443 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-8443 being exploited in the wild.

**How severe is CVE-2026-8443?** High severity, with a CVSS score of 8.8, published 16 June 2026.

**Which products and versions are affected?** WP Review Slider Review Slider up to, and including, 12.6.8; WP Review Slider Review Slider Pro up to, and including, 12.6.8.

**Is there a fix for CVE-2026-8443?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-8443 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-8443?** Check whether you run WP Review Slider Review Slider or WP Review Slider Review Slider Pro at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A SQL injection vulnerability exists in the WP Review Slider Pro plugin due to improper handling of user-supplied JSON strings in the 'stypes' and 'slocations' parameters of the wppro_get_overall_chart_data AJAX action. The plugin uses stripslashes() on these strings before calling json_decode(), which bypasses WordPress's built-in magic quotes protection. The resulting array values are then concatenated directly into SQL WHERE clauses without parameterization or use of $wpdb->prepare(). Authenticated attackers with Subscriber-level access or higher can exploit this to execute arbitrary SQL queries and extract sensitive data. The vulnerability is further simplified for attackers because the AJAX handler returns the executed SQL string in its JSON response, facilitating the construction of exploitation oracles.

## Affected products

- WP Review Slider WP Review Slider Pro up to, and including, 12.6.8

## Timeline

- 2026-06-16: disclosed: CVE published to NVD dataset
- 2026-06-16: advisory: Wordfence advisory published

## References

- [https://wpreviewslider.com/](https://wpreviewslider.com/)
- [https://www.wordfence.com/threat-intel/vulnerabilities/id/1055bba0-7dbd-4382-afaf-ecea442c527c?source=cve](https://www.wordfence.com/threat-intel/vulnerabilities/id/1055bba0-7dbd-4382-afaf-ecea442c527c?source=cve)