CVE-2026-17582 is a second-order SQL Injection vulnerability in the Slider Hero with Video Background, Animation WordPress plugin by quantumcloud. The issue arises because the qcld_sliderhero_duplicate() function re-reads slide data columns and concatenates them directly into an SQL INSERT VALUES statement executed via $wpdb->query() without using $wpdb->prepare(), esc_sql(), or similar sanitization functions. Although slide data is initially stored safely using $wpdb->update() with placeholders, the duplication function fails to sanitize the data before reuse. This allows authenticated users with administrator privileges to inject additional SQL queries, potentially exposing sensitive database information. The vulnerability affects versions up to and including 9.1.7. No vendor advisory or patch is currently provided.

An attacker with administrator-level access can exploit this vulnerability to execute additional SQL queries on the database, potentially extracting sensitive information. The vulnerability does not impact availability or integrity but compromises confidentiality. The CVSS score of 4.9 reflects a medium severity due to the requirement for high privileges and lack of user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrator access to trusted users only and monitor for suspicious activity related to slide duplication features. Avoid using the 'heroduplicateslider' task if possible.