What is the CVSS score of CVE-2026-14244?

CVE-2026-14244 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.7%.

Which versions of Jssor Slider are affected by CVE-2026-14244?

The Jssor Slider WordPress plugin (versions ≤3.1.24) contains a file disclosure vulnerability that exposes sensitive server files and database credentials to unauthenticated attackers, with no vendor…

How to fix or mitigate CVE-2026-14244?

Within 24 hours: Inventory all WordPress installations running Jssor Slider plugin versions ≤3.1.24, immediately deactivate the plugin on all affected systems, and document affected installations for remediation tracking. Within 7 days: Implement Web Application Firewall (WAF) rules to block HTTP requests containing the 'url' parameter targeting the vulnerable plugin endpoints, enable monitoring and alerting for file access attempts to wp-config.php and other sensitive files, and retrospectively search web server logs for indicators of exploitation attempts. Within 30 days: Monitor jssor.com and Wordfence for patch availability (watch for version 3.1.25 or later), validate any patched version in a staging environment before production rollout, and conduct forensic analysis of system and database logs to identify any unauthorized access or credential theft during the vulnerability window.

Jssor Slider CVE-2026-14244

EUVD-2026-42159 HIGH

Path Traversal (CWE-22)

2026-07-08 Wordfence

GHSA-j9c4-4mg9-mwfh

WordPress Path Traversal Wordpress Plugin Jssor Slider By Jssor Com

7.5

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Unauthenticated network-reachable path traversal (AV:N/AC:L/PR:N/UI:N) yielding arbitrary file read, so C:H with no integrity or availability impact and unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 08, 2026 - 05:27 vuln.today

CVE Published

Jul 08, 2026 - 04:30 nvd

HIGH 7.5

DescriptionCVE.org

The Jssor Slider by jssor.com plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.1.24 via the 'url' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.

AnalysisAI

Arbitrary file disclosure in the Jssor Slider by jssor.com WordPress plugin (all versions through 3.1.24) lets unauthenticated remote attackers traverse the filesystem via the 'url' parameter and read the contents of any file the web server can access, such as wp-config.php. Wordfence disclosed the flaw and points to the plugin's admin controller code; no public exploit is identified at time of analysis and it is not listed in CISA KEV. EPSS was not provided, but the network-reachable, unauthenticated nature of the bug makes it an attractive scanning target.

Technical ContextAI

The affected component is a WordPress plugin (CPE cpe:2.3:a:jssor:jssor_slider_by_jssor.com) that provides image-slider functionality and includes an admin-side controller (class-jssor-slider-admin-controller.php) reached through the plugin's dispatcher (jssor-slider-dispatcher.php). The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), meaning a user-supplied 'url' value is concatenated into a filesystem path and used to open/read a file without normalizing or constraining it to an intended base directory. Sequences such as '../' therefore escape the plugin directory and resolve to arbitrary paths on the server (referenced code lines include L307, L414 and L506 of the admin controller). Because WordPress plugins typically run with the privileges of the PHP/web-server process, readable targets include configuration files, credentials, and other files within that process's reach.

RemediationAI

No vendor-released patch identified at time of analysis - all versions through 3.1.24 are listed as vulnerable and no fixed version is provided, so upgrading is not yet a confirmed option; monitor the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/0cd880c9-75fe-420b-ae41-558678adb57b?source=cve) and the plugin page for a release above 3.1.24. As the primary compensating control, deactivate and remove the Jssor Slider plugin until a fixed version ships, accepting the trade-off that slider content will stop rendering. If removal is not acceptable, use a WAF (such as Wordfence) to block requests to the plugin's dispatcher/admin-controller endpoints containing path-traversal patterns (e.g., '../', encoded '%2e%2e', or absolute paths) in the 'url' parameter, understanding that WAF rules can be bypassed and require tuning; additionally restrict web-server file permissions and consider open_basedir to constrain which files PHP can read, which limits - but does not eliminate - the files an attacker can disclose.