The Slider by 10Web – Responsive Image Slider plugin for WordPress suffers from a time-based SQL Injection vulnerability via the 'id' parameter in versions up to 1.2.57. The vulnerability arises from improper neutralization of special elements in SQL commands (CWE-89), specifically insufficient escaping of user input and lack of prepared statements. Authenticated attackers with Contributor-level privileges or higher can append malicious SQL queries to extract sensitive data from the database. The CVSS 3.1 score is 8.8, indicating high severity with network attack vector, low attack complexity, requiring privileges, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows authenticated users with Contributor or higher privileges to perform time-based SQL Injection attacks, potentially leading to unauthorized disclosure of sensitive information, modification of database contents, and disruption of service. This compromises the confidentiality, integrity, and availability of the affected WordPress site's data managed by the plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access and above to trusted users only. Monitor for updates from 10Web regarding a security patch or official mitigation. Avoid exposing the vulnerable plugin on publicly accessible sites without proper access controls.