Slider by 10Web CVE-2026-66635

Exploitation requires that the victim be authenticated to WordPress as an administrator (or another role with sufficient privileges to trigger the plugin's file-deletion functionality) and that they visit an attacker-controlled web page or load attacker-supplied content while their admin session is active. The attacker does not need any credentials or prior access to the target WordPress installation. The plugin must be installed and active on the target site. Exploitation is limited by the social-engineering step: the victim must be induced to visit the malicious page, and the attack window is bounded by the duration of the admin session cookie. The file-deletion scope (which specific files can be targeted) is constrained by what paths the plugin's endpoint accepts; the exact parameter surface is not detailed in available intelligence beyond the 'arbitrary file deletion' characterization in the Patchstack title.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H) assigns a 7.4 High score, driven primarily by the network-reachable attack surface, low complexity, unauthenticated attacker posture, and high availability impact with scope change. The UI:R dependency is a meaningful real-world mitigator: exploitation requires that a logged-in WordPress administrator be socially engineered into visiting an attacker-controlled page. EPSS data was not provided in the source intelligence, so quantitative exploitation probability cannot be stated. No CISA KEV listing exists, and no POC is confirmed, making this a credible-but-unconfirmed exploitation risk rather than an active threat. However, the file-deletion primitive is disproportionately damaging: an attacker who can delete arbitrary files can remove core WordPress files, break the site's availability, or pre-stage further compromise by removing security plugins. The I:N metric in the official vector warrants scrutiny - file deletion is commonly treated as an integrity violation as well; see assessed vector below.

An attacker identifies a WordPress site running Slider by 10Web 1.2.62 or earlier, crafts an HTML page containing a hidden form or JavaScript-triggered request targeting the plugin's file-deletion action with no CSRF token, then delivers the link to the site's administrator via phishing email or social media. When the logged-in admin loads the attacker's page, their browser automatically submits the forged request with the admin's session cookies, causing the plugin to delete one or more specified files on the server - potentially including WordPress core files, configuration, or security tooling - without any indication to the victim.