HIGH SeverityCVSS 3.18.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVE-2026-6692

Last updated May 07, 2026 · Published May 07, 2026

Description

The Slider Revolution plugin for WordPress is vulnerable to Arbitrary File Upload in versions 7.0.0 to 7.0.10 via the '_get_media_url' and '_check_file_path' function. This is due to insufficient file type validation. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. The vulnerability was partially patched in version 7.0.10 and fully patched in version 7.0.11.

Affected products

1 listed

Revolution Slider:Slider Revolution

Mappings

CWE

CWE-434

CAPEC

None listed.

Research

File upload security: validation, isolation, and scanningInsecure file uploads are still one of the fastest paths to RCE. Validate type and size, store outside the web…

Guides

Secure File Uploads in Node.jsValidation, scanning, storage isolation, and safe serving patterns.

Training

CVE-2026-6692

Description

Affected products

Mappings

Related