CVE-2026-8443: WP Review Slider Pro <= 12.6.8 - Authenticated (Subscriber+) SQL Injection via 'stypes' Parameter

Synopsis

This is an authenticated SQL injection vulnerability in the WP Review Slider Pro WordPress plugin, affecting all versions up to and including 12.6.8. The flaw is reachable over the network by any logged-in user with at least a Subscriber-level account, meaning no elevated privileges are needed. Successful exploitation lets an attacker extract arbitrary data from the WordPress database, modify stored data, and disrupt data availability. HarborGuard is tracking the advisory for patch availability, as no fix version has been published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable AJAX action is exposed over the network via HTTP, so an attacker must be able to reach the WordPress installation across the internet or an internal network.

• AuthenticationRequired

  A valid WordPress account at Subscriber level or above is required; any low-privilege registered account is sufficient to trigger the vulnerable endpoint.

• Victim interactionNot required

  No victim interaction is needed; the attacker sends crafted requests directly to the AJAX handler without involving any other user.

• Attack complexityDetail

  Attack complexity is low: the exploit is reliable and condition-free, and the handler leaks the constructed SQL string in its JSON response, which further simplifies blind injection enumeration.

Blast Radius

• Reads arbitrary database tables, including WordPress user credentials (hashed passwords), email addresses, session tokens, and plugin configuration data.
• Reads sensitive application records such as stored reviews, business data, and any custom post-type content held in the database.
• Modifies persisted database rows, including user roles, plugin settings, or site options, by appending write-capable SQL statements.
• Disrupts data integrity or availability by injecting destructive SQL that corrupts or deletes table contents.