Atomic Edge analysis of CVE-2026-17582: The Slider Hero WordPress plugin contains a second-order SQL Injection vulnerability in versions up to and including 9.1.7. An authenticated user with Administrator-level capabilities can exploit the slide duplication function to inject malicious SQL queries, potentially extracting sensitive data from the database. The CVSS score is 4.9, reflecting the high privilege requirement but significant potential for data compromise.
The root cause lies in the qcld_sliderhero_duplicate() function within the qcld-slider-main.php file. The function, triggered by the ‘heroduplicateslider’ task, selects all slides associated with a slider and then constructs an INSERT query by directly concatenating the raw values of the ‘title’, ‘slide’, ‘description’, and other fields into a string. This string is then passed to $wpdb->query() without using $wpdb->prepare() or any escaping. Although the qchero_save_image AJAX handler stores these fields safely using $wpdb->update() with %s placeholders, the duplication path completely bypasses this protection.
Exploitation is a two-step process. First, an authenticated administrator must, through the plugin’s settings or via the qchero_save_image AJAX action, insert a malicious SQL payload into a slide’s ‘description’ field (or another unsanitized text field). The payload is stored in the wp_qcld_slider_hero_slides table. Second, the attacker triggers the duplication process by navigating to admin.php with the ‘task’ set to ‘heroduplicateslider’ and the ‘id’ parameter pointing to the slider containing the malicious slide. The vulnerable function then reads the malicious value and injects it into the SQL query, which is executed against the database.
The patch replaces the string concatenation in qcld_sliderhero_duplicate() with the $wpdb->insert() method. The $wpdb->insert() function processes each data value through its own internal escaping and quoting mechanism, which is equivalent to using %s placeholders in $wpdb->prepare(). This ensures that the raw values from the database are safely interpolated into the SQL query, preventing any SQL code within the slide fields from being executed.
Successful exploitation allows an attacker with Administrator credentials to execute arbitrary SQL queries. This can lead to the extraction of all database contents, including password hashes, user email addresses, and other sensitive information stored by the WordPress installation. While the privilege requirement limits the immediate attack surface, any compromise of an administrator account or a malicious insider could leverage this vulnerability for broader data exfiltration.
