What is the CVSS score of EUVD-2026-28321?

EUVD-2026-28321 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Slider Revolution are affected by EUVD-2026-28321?

Slider Revolution for WordPress versions 7.0.0-7.0.10 contain a remote code execution vulnerability allowing subscriber-level users to upload and execute malicious files, potentially giving attackers…

How to fix or mitigate EUVD-2026-28321?

Within 24 hours: Identify all WordPress installations with Slider Revolution 7.0.0-7.0.10 using plugin inventory tools or WP-CLI; disable the plugin if immediate patching is not possible. Within 7 days: Upgrade Slider Revolution to version 7.0.11 or later on all affected installations; verify the upgrade in admin console. Within 30 days: Audit access logs and file uploads from the past 90 days for evidence of exploitation; reset credentials for any subscriber accounts not actively in use; implement Web Application Firewall rules to restrict plugin upload endpoints to trusted users.

Slider Revolution EUVD-2026-28321

| CVE-2026-6692 HIGH

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-05-07 Wordfence

GHSA-6j7r-xh37-g6x3

WordPress File Upload RCE

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 07, 2026 - 05:46 vuln.today

CVE Published

May 07, 2026 - 04:27 nvd

HIGH 8.8

DescriptionCVE.org

The Slider Revolution plugin for WordPress is vulnerable to Arbitrary File Upload in versions 7.0.0 to 7.0.10 via the '_get_media_url' and '_check_file_path' function. This is due to insufficient file type validation. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. The vulnerability was partially patched in version 7.0.10 and fully patched in version 7.0.11.

AnalysisAI

Remote code execution in Slider Revolution for WordPress versions 7.0.0 through 7.0.10 allows authenticated attackers with subscriber-level privileges to upload executable files via insufficient file type validation in '_get_media_url' and '_check_file_path' functions. A partial patch in 7.0.10 was insufficient, requiring upgrade to 7.0.11 for complete remediation. With CVSS 8.8 (High) and low privilege requirements (subscriber accounts are commonly available or easily created), this represents significant risk for WordPress installations using affected versions, though no active exploitation has been confirmed via CISA KEV at time of analysis.

Technical ContextAI

Slider Revolution is a widely-deployed premium WordPress slider and visual builder plugin. The vulnerability stems from CWE-434 (Unrestricted Upload of File with Dangerous Type) in the media handling functions '_get_media_url' and '_check_file_path'. These functions fail to properly validate file types during upload operations, allowing attackers to bypass intended restrictions. WordPress plugins execute PHP code server-side, so uploading a PHP webshell or malicious executable grants direct code execution in the web server context. The affected CPE (cpe:2.3:a:revolution_slider:slider_revolution) confirms this is a plugin-level vulnerability affecting the Revolution Slider product from ThemePunch across versions 7.0.0-7.0.10. The CVSS vector AV:N indicates network-based exploitation, while PR:L confirms authenticated (low-privilege) access is required, consistent with the description's mention of subscriber-level accounts.

RemediationAI

Upgrade immediately to Slider Revolution version 7.0.11 or later, which contains the complete patch for this arbitrary file upload vulnerability. Version 7.0.10 contains only a partial fix and must not be considered secure. Administrators should verify the installed version via WordPress admin dashboard under Plugins and update through the plugin's update mechanism or by downloading from https://www.sliderrevolution.com/. After patching, conduct a security review to identify any suspicious files uploaded during the vulnerable period, particularly in wp-content/uploads/ and plugin-specific directories. If immediate patching is not possible, implement these compensating controls with noted trade-offs: (1) Temporarily deactivate the Slider Revolution plugin until upgrade is completed - this breaks existing slider functionality but eliminates the attack surface; (2) Restrict new user registration and audit existing subscriber accounts, removing untrusted users - this reduces attacker entry points but doesn't prevent exploitation by existing malicious subscribers; (3) Implement web application firewall rules to block suspicious file upload patterns to the affected functions - this may cause false positives for legitimate media uploads and requires ongoing tuning. Consult Wordfence advisory for additional indicators of compromise.