The WP Review Slider Pro WordPress plugin (up to version 12.6.8) contains an SQL Injection vulnerability in the wppro_get_overall_chart_data AJAX action. This occurs because stripslashes() is applied to user-supplied JSON strings before json_decode(), removing escaping added by WordPress's wp_magic_quotes. The decoded array values are then concatenated directly into SQL WHERE clauses without using $wpdb->prepare(), and the query is executed via $wpdb->get_results(). Authenticated attackers with Subscriber-level privileges can append malicious SQL to extract sensitive data. Additionally, the executed SQL query is returned in the JSON response, facilitating blind SQL injection attacks.

Successful exploitation allows authenticated users with low privileges (Subscriber-level and above) to perform SQL Injection attacks, potentially leading to unauthorized disclosure of sensitive database information, modification of data, and disruption of application availability. The exposure of the executed SQL query in the response further aids attackers in crafting effective exploits.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected AJAX action to trusted users only, and consider disabling the plugin or the vulnerable feature if possible. Monitor vendor channels for an official patch or update addressing this vulnerability.