CVE-2026-6692

HIGH EXPLOITED

Slider Revolution 7.0.0 - 7.0.10 - Authenticated (Subscriber+) Arbitrary File Upload via _get_media_url

Title source: cna

Exploitation Summary

CVE-2026-6692 has been observed exploited in the wild (reported by VulnCheck KEV).

Description

The Slider Revolution plugin for WordPress is vulnerable to Arbitrary File Upload in versions 7.0.0 to 7.0.10 via the '_get_media_url' and '_check_file_path' function. This is due to insufficient file type validation. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. The vulnerability was partially patched in version 7.0.10 and fully patched in version 7.0.11.

References (2)

Core 2

Core References

https://www.wordfence.com/threat-intel/vulnerabilities/id/a2e802a6-d2f1-47cc-883a-89110e569168?source=cve

https://www.sliderrevolution.com/

Scores

CVSS v3 8.8

EPSS 0.0063

EPSS Percentile 45.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

VulnCheck KEV 2026-05-07

CWE

CWE-434

Status published

Products (1)

Revolution Slider/Slider Revolution 7.0.0 - 7.0.10

Published May 07, 2026

Tracked Since May 07, 2026