Product Slider For Woocommerce EUVD-2026-15734

The risk assessment for this vulnerability is complicated by the absence of CVSS scoring, EPSS probability data, and KEV inclusion status. However, several factors suggest meaningful risk: (1) the vulnerability affects all versions through 1.13.60, indicating a longstanding flaw; (2) it is documented by Patchstack, a reputable vulnerability disclosure platform, suggesting active researcher awareness; (3) missing authorization (CWE-862) typically has high real-world impact because it bypasses core security controls rather than requiring exploitation of complex technical conditions. The lack of a CVSS vector prevents assessment of attack complexity and required privileges, but CWE-862 vulnerabilities in WordPress plugins are generally considered exploitable with low complexity once discovered. Without EPSS data or proof-of-concept confirmation, definitive exploitation probability cannot be stated, but the simplicity of authorization bypass attacks and the wide deployment of WordPress plugins suggests moderate-to-high real-world risk. The absence of a patched version statement in the available references may indicate the vulnerability is either still unpatched or recently disclosed.

An attacker with a low-privilege WordPress account (e.g., subscriber or contributor role) or no authentication at all can access the Product Slider configuration interface due to missing authorization checks. The attacker then modifies slider settings to display malicious product content, inject JavaScript, or redirect users to a phishing site. Alternatively, if the plugin exposes REST API endpoints without authorization, a remote unauthenticated attacker could programmatically alter slider configurations via HTTP requests, affecting all customers viewing the storefront. No proof-of-concept code is currently confirmed in the available intelligence, but the straightforward nature of authorization bypass exploitation suggests functional exploits are likely feasible.