The Slider Hero plugin for WordPress (up to version 9.1.7) is vulnerable to a second-order SQL Injection via the qcld_sliderhero_duplicate() function. Although slide data is initially stored safely using parameterized queries, the duplication function re-reads slide data and concatenates raw values directly into an SQL INSERT statement executed with $wpdb->query() without any sanitization or preparation. This enables authenticated users with administrator privileges to append malicious SQL commands, potentially extracting sensitive database information.

An attacker with administrator-level access can exploit this vulnerability to execute arbitrary SQL queries on the database, leading to unauthorized disclosure of sensitive information. The vulnerability does not allow privilege escalation or denial of service but compromises data confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted users only and monitor for suspicious activity related to the 'heroduplicateslider' task. Avoid using vulnerable versions if possible.