Description

The Slider Hero plugin for WordPress is vulnerable to second-order SQL Injection in versions up to, and including, 9.1.7 via the qcld_sliderhero_duplicate() function. Slide data (description, title, btn, btn2, image_link, custom, etc.) is stored safely via $wpdb->update() with %s placeholders in the qchero_save_image AJAX handler, but when an administrator triggers the 'heroduplicateslider' task, qcld_sliderhero_duplicate() re-reads every slide column and concatenates the raw values directly into an INSERT VALUES tuple that is then executed with $wpdb->query() — with no $wpdb->prepare(), esc_sql(), or _real_escape_string in between. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.9",
  "pubDate": "2026-08-16T06:16:51.563Z",
  "pubdate": "2026-08-16T06:16:51.563Z",
  "executiveSummary": "A second-order SQL Injection vulnerability exists in the Slider Hero plugin for WordPress in versions up to, and including, 9.1.7. The flaw resides within the qcld_sliderhero_duplicate() function, which improperly handles slide data during slider duplication tasks.\nWhile initial data ingestion through the qchero_save_image AJAX handler securely stores slide parameters using $wpdb->update() with parameterized %s placeholders, subsequent retrieval and duplication operations fail to sanitize or parameterize the stored values.\nAn authenticated attacker possessing administrator-level access or higher can leverage this vulnerability to execute arbitrary SQL commands by injecting malicious payloads into slide metadata fields such as description, title, btn, btn2, image_link, and custom.\nWhen an administrator triggers the heroduplicateslider task, the vulnerable function re-reads the raw column values and concatenates them directly into an INSERT VALUES tuple executed via $wpdb->query().\nThis absence of $wpdb->prepare(), esc_sql(), or _real_escape_string mechanisms allows the appended SQL queries to execute successfully against the underlying database.\nThe primary impact of successful exploitation includes unauthorized database access, enabling attackers to extract sensitive information from the database. Exploitation requires administrative privileges within the WordPress environment and authenticated access to the management interface.",
  "technicalDetails": "The vulnerability is classified as a second-order SQL Injection affecting the Slider Hero plugin for WordPress across all versions up to, and including, 9.1.7. The core vulnerability stems from insecure data handling practices during internal record duplication rather than direct input ingestion.\nDuring the initial data lifecycle phase, user-supplied slide data including fields such as description, title, btn, btn2, image_link, and custom are processed via the qchero_save_image AJAX handler. This ingestion phase is secure, utilizing the WordPress database abstraction layer method $wpdb->update() with explicit %s placeholders to ensure proper sanitization and parameterization before database storage.\nHowever, the flaw manifests when the application attempts to duplicate existing records. Specifically, the qcld_sliderhero_duplicate() function is invoked when an administrator triggers the 'heroduplicateslider' task. Instead of retrieving and processing records securely, this function re-reads every slide column from the database and extracts the stored, potentially malicious raw values.\nThe root cause of the vulnerability is the direct concatenation of these raw, unsanitized database values into an SQL INSERT VALUES tuple. The resulting query string is subsequently executed using $wpdb->query() without any intervening sanitization mechanisms such as $wpdb->prepare(), esc_sql(), or _real_escape_string.\nThe attack flow proceeds in two distinct stages. In the first stage, an authenticated attacker with administrator privileges stores a specially crafted SQL payload within one of the mutable slide parameters through standard administrative update interfaces. Because the initial storage mechanism uses parameterized queries, the payload is safely written to the database without triggering immediate execution.\nIn the second stage, the attacker triggers the slider duplication routine via the 'heroduplicateslider' task. Upon execution, qcld_sliderhero_duplicate() queries the previously stored malicious payload from the database and concatenates it directly into the new SQL INSERT statement.\nBecause the database engine evaluates the concatenated string as executable SQL code rather than literal data, the injected statements break out of the intended query context. This enables the attacker to append arbitrary SQL commands, union additional result sets, or execute stacked queries depending on the underlying database configuration.\nPrerequisites for successful exploitation include administrative-level access or higher within the WordPress target instance and the ability to interact with the plugin's AJAX or administrative task routing endpoints. The post-exploitation impact includes unauthorized data exfiltration, enabling attackers to extract sensitive database contents, including user credentials, configuration data, and other application secrets stored within the database."
}