Slider Revolution EUVD-2026-28321

Requires authenticated access with subscriber-level privileges or higher on the target WordPress installation. Subscriber is the lowest privilege tier in WordPress, typically granted to registered users and often available through public registration forms on membership sites, blogs, and community portals. The target site must have Slider Revolution plugin versions 7.0.0 through 7.0.10 actively installed. No special plugin configuration or feature enablement is required beyond default installation. Exploitation is limited by the need for valid WordPress credentials, but the low privilege requirement significantly expands the potential attacker pool compared to vulnerabilities requiring administrator access. Sites that disable user registration or restrict account creation to trusted users face lower risk, though compromised existing accounts remain a vector.

Real-world risk is HIGH despite lack of confirmed exploitation. The CVSS score of 8.8 accurately reflects the severe impact (C:H/I:H/A:H) and ease of exploitation (AC:L, no user interaction required). While no EPSS score or CISA KEV status is provided in available data, the low barrier to exploitation is concerning: WordPress subscriber accounts are the lowest privilege tier, often freely available through public registration on blogs and membership sites. The attack vector is network-based with low complexity, meaning any authenticated user can potentially exploit this without specialized skills. The partial patch in 7.0.10 indicates complexity in the vulnerability that required iterative fixes, suggesting potential for bypass or incomplete remediation in intermediate versions. No public exploit code is confirmed from provided references, which may limit immediate widespread exploitation, but the technical details disclosed by Wordfence provide sufficient information for capable attackers to develop exploits. Priority should be HIGH for any WordPress installation running Slider Revolution 7.0.0-7.0.10, especially those allowing public user registration or with untrusted subscriber accounts.

An attacker creates a subscriber account on a WordPress site running Slider Revolution 7.0.0-7.0.10, either through public registration if enabled or by compromising existing low-privilege credentials. The attacker crafts a malicious HTTP request to the plugin's media upload functionality, exploiting the '_get_media_url' or '_check_file_path' functions to upload a PHP webshell disguised with insufficient file type validation. Once uploaded, the attacker accesses the webshell via direct HTTP request to execute arbitrary system commands with web server privileges, enabling data exfiltration, further privilege escalation, or complete site compromise.