Slider by 10Web EUVD-2026-94302

Requires an authenticated WordPress user with high privileges (CVSS PR:H - typically administrator-level) and network access to the Slider by 10Web plugin's vulnerable request handler on a site running version 1.2.63 or earlier. Exploitation is blind, so data is extracted inferentially rather than returned directly. The dominant limiting factor is the high-privilege authentication requirement: an unprivileged or anonymous user cannot reach the vulnerable code path, which confines realistic abuse to malicious or compromised admin/high-role accounts. No user interaction is required once authenticated.

The input CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L, score 7.6) describes a network-reachable, low-complexity blind SQL injection that nonetheless requires high privileges (PR:H) to reach the vulnerable code path - a critical mitigating factor. No EPSS score, CISA KEV listing, or public POC was supplied, so there is no evidence of active or imminent widespread exploitation; this sits at 'no public exploit identified at time of analysis.' The PR:H requirement means an attacker must already hold an administrator/high-privilege WordPress account, which substantially lowers real-world risk and makes this more of a post-authentication/privilege-abuse issue than an opportunistic internet-wide threat. The scope-change flag (S:C) and C:H in the input inflate the headline severity; for a blind SQLi that primarily enables database reads, the integrity and scope impact are debatable. Net assessment: a genuine vulnerability worth patching, but a moderate rather than urgent priority given the high-privilege precondition and the absence of exploitation signals. No conflicting signals between network vector and description, but note the high-privilege gate is the dominant limiting factor.

An attacker who already holds a high-privilege WordPress account (e.g., administrator) on a site running Slider by 10Web ≤ 1.2.63 submits crafted input to a vulnerable plugin parameter. Because the injection is blind, they infer database contents through boolean/time-based responses, progressively extracting sensitive data such as user records or password hashes. No public exploit code was identified at the time of analysis.