CVE-2026-8443 describes an SQL Injection vulnerability in WP Review Slider Pro plugin for WordPress (<=12.6.8). The flaw exists in the wppro_get_overall_chart_data AJAX action where the 'stypes' and 'slocations' parameters are processed insecurely. The plugin uses stripslashes() on user-supplied JSON strings before decoding, which removes escaping added by WordPress's wp_magic_quotes. The decoded array values are then concatenated directly into SQL WHERE clauses without using $wpdb->prepare(), and the query is executed with $wpdb->get_results(). This allows authenticated attackers with Subscriber-level privileges or higher to append arbitrary SQL queries, potentially extracting sensitive data. The response includes the executed SQL string, facilitating blind SQL injection attacks.

An attacker with at least Subscriber-level access can exploit this vulnerability to perform SQL Injection attacks, potentially extracting sensitive information from the database. The vulnerability affects confidentiality, integrity, and availability, as indicated by the CVSS vector (C:H/I:H/A:H). The exposure of the executed SQL query in the response simplifies exploitation and increases the risk of data leakage.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected AJAX action to trusted users only and consider disabling the WP Review Slider Pro plugin if possible. Avoid using vulnerable versions (<=12.6.8). Monitor the vendor's website or security advisories for updates or patches addressing this vulnerability.