Medium Security Advisory Disclosed 2026-10-26
Identity withheld until 2027-01-24 (90 days). The maintainer/vendor was notified on 2026-10-26 and has a 90-day window to remediate before the affected software is named. This page is unlisted and not indexed until then. codelake never stores raw secrets.
Advisory · CLR-2026-3686

Authenticated SQL injection (backslash bypass) in a WordPress vertical image-slider plugin

Image-title values are concatenated into unprepared INSERT/UPDATE statements; escaping of quotes misses backslashes, allowing string-literal breakout on standard SQL modes. Sinks are nonce- and capability-gated (administrator-only). The vendor will be notified under a 90-day coordinated-disclosure window; details are revealed automatically on the reveal date.

MediumCoordinated disclosure
Summary

a WordPress vertical image-slider plugin stores image titles by interpolating them into $wpdb INSERT/UPDATE statements without prepare(). Applied escaping removes quotes but not backslashes, so a title containing a backslash can break out of the SQL string literal (behaviour depends on the SQL mode). All affected paths are behind administrator capability checks and valid nonces. The affected release is current release.

Technical detail
🔒
Technical detail withheld until 2027-01-24 (90 days). The affected package, version, vulnerability class and remediation are public on this page. The exact code location, sink and reproduction are held back to limit exploitation while the issue is unpatched, and are revealed automatically once the coordinated-disclosure window closes.
Remediation
🔒
Technical detail withheld until 2027-01-24 (90 days). The affected package, version, vulnerability class and remediation are public on this page. The exact code location, sink and reproduction are held back to limit exploitation while the issue is unpatched, and are revealed automatically once the coordinated-disclosure window closes.

Reported by codelake Research (https://research.codelake.dev) under coordinated disclosure. The affected software's identity and the exact technical detail are withheld until the reveal date, then revealed automatically.