EUVD-2026-60920
GHSA-92pc-3cww-h4mx
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H
File deletion constitutes both an integrity (I:H) and availability (A:H) impact; official vector's I:N understates destructive write impact on WordPress filesystem.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Cross Site Request Forgery (CSRF) in Slider by 10Web <= 1.2.62 versions.
AnalysisAI
Arbitrary file deletion via unauthenticated CSRF in the Slider by 10Web WordPress plugin (versions up to and including 1.2.62) enables a remote attacker to delete files on the WordPress host by tricking an authenticated administrator into visiting a malicious page. Per the Patchstack advisory title, the CSRF primitive chains directly to arbitrary file deletion, which is reflected in the CVSS 3.1 score of 7.4 (High) with Scope Changed (S:C) and High Availability impact (A:H), indicating the destruction extends beyond the plugin itself to the broader WordPress installation or filesystem. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the victim be authenticated to WordPress as an administrator (or another role with sufficient privileges to trigger the plugin's file-deletion functionality) and that they visit an attacker-controlled web page or load attacker-supplied content while their admin session is active. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H) assigns a 7.4 High score, driven primarily by the network-reachable attack surface, low complexity, unauthenticated attacker posture, and high availability impact with scope change. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary remediation is to update the Slider by 10Web plugin to a version higher than 1.2.62 that includes nonce validation on the vulnerable file-deletion endpoint. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: disable or remove the Slider by 10Web plugin version 1.2.62 and earlier from all WordPress installations; check server logs for signs of unauthorized file deletions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today