SliceWP Through 1.2.14 - Actively Exploited Unauthenticated SQL Injection (CVE-2026-120043)

SliceWP versions 1.2.14 and earlier are vulnerable to an unauthenticated SQL injection tracked as CVE-2026-120043. Patchstack lists the issue as actively exploited, and the vendor has released SliceWP 1.2.15 with additional variable escaping. Sites using SliceWP with WooCommerce registration should update immediately.

Table of Contents

Vulnerability summary

Product: Affiliate Program Suite – SliceWP Affiliates
Affected versions: SliceWP 1.2.14 and earlier
Fixed version: SliceWP 1.2.15
CVE: CVE-2026-120043
Attack class: Unauthenticated SQL injection
Severity: Critical 9.3 according to Patchstack; High 7.5 according to Wordfence
Exposure: More than 10,000 active installations are listed by WordPress.org
Exploitation status: Patchstack marks the vulnerability as known exploited. This is Patchstack exploitation telemetry, not a CISA Known Exploited Vulnerabilities designation.

Prerequisites and exploit path

Wordfence attributes the flaw to insufficient escaping and SQL preparation of the email parameter. The vulnerable logic can be reached when SliceWP processes the WordPress user_register hook after a successful WooCommerce My Account registration. An attacker does not need an existing account; Wordfence reports that the required registration nonce is available to a guest.

A practical exposure condition is therefore a site running a vulnerable SliceWP version with the WooCommerce My Account registration flow publicly reachable. Successful exploitation can allow an unauthenticated attacker to extract sensitive information from the WordPress database. This article intentionally omits exploit payloads.

Immediate remediation

Update SliceWP to version 1.2.15 or later.
Purge page, object, and CDN caches after the update.
Confirm that the installed plugin version is no longer 1.2.14 or earlier.
Review recent user registrations, administrator accounts, application passwords, and database activity for signs of compromise.
If the update cannot be applied immediately, deactivate SliceWP. As a temporary mitigation, also disable public WooCommerce My Account registration until the patched plugin is installed.

WP-CLI verification

wp plugin get slicewp --fields=name,status,version,update,update_version
wp plugin update slicewp
wp option get woocommerce_enable_myaccount_registration
wp user list --fields=ID,user_login,user_email,user_registered --orderby=registered --order=DESC
wp db check

The plugin version check should report 1.2.15 or later. The user list helps identify unexpected recent accounts, but it is not proof by itself that exploitation occurred.

Indicators to investigate

Unexpected WooCommerce My Account registrations or unfamiliar WordPress users.
Repeated registration requests containing malformed or unusually long email values.
SQL errors, timing anomalies, or bursts of requests to the My Account registration endpoint.
Unknown administrator accounts, application passwords, scheduled tasks, or modified security settings.
Evidence that database contents were exported or accessed outside normal application behavior.

If compromise is suspected, preserve web and WAF logs before cleanup, rotate WordPress administrator and database credentials, revoke unknown application passwords, inspect modified files, and restore only from a verified clean backup.

Patch verification

The official WordPress.org changelog for SliceWP 1.2.15 lists additional variable escaping. Administrators should verify the running version directly rather than relying only on an update notification or cache state.

SliceWP Through 1.2.14 – Actively Exploited Unauthenticated SQL Injection (CVE-2026-120043)