Image Slider By Ays CVE-2026-32402

The CVSS 3.1 score of 5.3 represents a moderate severity rating with a low attack complexity (AV:N/AC:L/PR:N), indicating the vulnerability is easily exploitable remotely by unauthenticated users. However, the impact is limited to integrity (I:L) with no confidentiality or availability impact, making this primarily a data tampering risk rather than a complete system compromise. The attack vector (network-based, no authentication required, no user interaction) indicates reasonable real-world exploitability, though the measured EPSS score would likely fall in the medium range given the integrity-only impact. For WordPress sites hosting important content or using this plugin for client-facing sliders, this represents a priority vulnerability due to the ease of exploitation and potential for content defacement or injection attacks, though it ranks below critical vulnerabilities. Active exploitation likelihood depends on KEV/POC availability and plugin popularity; given the specific nature of the access control flaw, targeted exploitation is probable if the plugin is widely deployed.

An attacker discovers a WordPress site using Ays Pro Image Slider version 2.7.1 through automated scanning for vulnerable plugins. Without needing to authenticate, the attacker sends a crafted HTTP request to the plugin's REST API endpoint (e.g., /wp-json/ays-slider/v1/update-slider or similar AJAX handler) with malicious slider content, such as injected JavaScript code or defaced image URLs. The missing authorization check allows the request to succeed, modifying the slider displayed on the website's frontend to redirect visitors to a phishing site or inject malicious advertisements, affecting all site visitors until the content is reverted by an administrator.