www.it-connect.fr
WordPress: Update Slider Revolution Now to Patch CVE-2026-6692
A critical vulnerability has been fixed in Slider Revolution, a WordPress plugin with more than 5 million active installations. This security flaw could let an attacker upload a malicious file and fully compromise a website. Here’s how to protect yourself.
A flaw in a popular plugin
As its name suggests, Slider Revolution is a WordPress extension used to create sliders for websites, combining design and motion. The plugin’s authors describe it as the number one slider plugin for WordPress. Unfortunately, it is affected by a security issue.
Indeed, on April 18, 2026, a critical vulnerability was reported through Wordfence’s Bug Bounty program by security researcher h0xilo. It allows arbitrary file uploads on the targeted WordPress site, which can lead to full compromise via remote code execution.
The security flaw lies in a lack of file extension validation when using certain plugin functions, including _check_file_path. More specifically, the AJAX action library.load.image is accessible to any authenticated user. As a result, an attacker with nothing more than an account assigned the "Subscriber" role (the default and lowest role on WordPress) can exploit this vulnerability.
This vulnerability allows the attacker to provide a URL pointing to a malicious PHP file they control. The plugin then downloads that file directly into the WordPress uploads directory, which is publicly accessible.
"As with all security flaws related to arbitrary file uploads, this can lead to full site compromise through webshells and other techniques.", Wordfence explains in its report.
How can you protect yourself from CVE-2026-6692?
This issue was introduced with the release of major version 7.0, associated with Slider Revolution 7. On its side, Wordfence estimates that around 45,000 websites are currently using a vulnerable version.
Here are the key details related to this discovery under the CVE-2026-6692 reference:
- CVSS score: 8.8 out of 10
- Affected versions: 7.0.0 to 7.0.10
- Fixed version: 7.0.11
In reality, the ThemePunch development team released an initial partial fix as early as April 22 (version 7.0.10), followed by a complete fix on May 4, 2026 with version 7.0.11. Finally, note that for this discovery, the security researcher received a handsome $4,914 reward.
