CVE-2026-17582
Received Received - Intake

Second-Order SQL Injection in Slider Hero WordPress Plugin

Publication date: 2026-08-16

Last updated on: 2026-08-16

Assigner: Wordfence

Description
The Slider Hero plugin for WordPress is vulnerable to second-order SQL Injection in versions up to, and including, 9.1.7 via the qcld_sliderhero_duplicate() function. Slide data (description, title, btn, btn2, image_link, custom, etc.) is stored safely via $wpdb->update() with %s placeholders in the qchero_save_image AJAX handler, but when an administrator triggers the 'heroduplicateslider' task, qcld_sliderhero_duplicate() re-reads every slide column and concatenates the raw values directly into an INSERT VALUES tuple that is then executed with $wpdb->query() — with no $wpdb->prepare(), esc_sql(), or _real_escape_string in between. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-16
Last Modified
2026-08-16
Generated
2026-08-16
AI Q&A
2026-08-16
EPSS Evaluated
N/A
NVD
CVE-2026-17582
EUVD
EUVD-2026-59902

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
slider_hero slider_hero to 9.1.7 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Slider Hero WordPress plugin has a second-order SQL Injection flaw in versions up to 9.1.7. The issue occurs in the qcld_sliderhero_duplicate() function. While slide data is safely stored via $wpdb->update() with placeholders, the duplicate function re-reads raw slide data and concatenates it directly into an INSERT VALUES query without proper escaping or preparation. This allows authenticated attackers with admin access to inject malicious SQL queries to extract sensitive database information.

Detection Guidance

This vulnerability requires administrator-level access to exploit, so detection should focus on monitoring for unusual SQL queries or unauthorized administrative actions. Check WordPress logs for suspicious AJAX calls to 'heroduplicateslider' or 'qchero_save_image' with unexpected parameters. Review database logs for concatenated SQL queries or unusual INSERT statements.

Impact Analysis

This vulnerability allows attackers with admin access to extract sensitive data from the WordPress database. They could steal user credentials, personal information, or other confidential data stored in the site's database. The attack requires administrative privileges but could lead to full database compromise if exploited.

Compliance Impact

This vulnerability could lead to unauthorized access and exfiltration of personal data, violating GDPR's data protection requirements and potentially HIPAA if health information is compromised. Organizations may face regulatory fines, legal consequences, and reputational damage due to data breaches resulting from this SQL injection flaw.

Mitigation Strategies

Immediately update the Slider Hero plugin to the latest version if available. If not, disable the plugin until a patch is released. Restrict administrative access to only necessary users and monitor for unauthorized actions. Review database queries for signs of exploitation and consider implementing a web application firewall to block malicious requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-17582. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart