PT-2026-20278 · WordPress · Slider Future

Zast.Ai · Published 2026-02-17 · Updated 2026-03-09 · CVE-2026-1405

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Slider Future versions up to and including 1.0.5

Description The Slider Future plugin for WordPress is susceptible to arbitrary file uploads because of a lack of file type validation within the slider future handle image upload function. This allows unauthenticated attackers to upload arbitrary files to the server, potentially leading to remote code execution.

Recommendations Deactivate the plugin immediately or apply the permission callback and extension filter patches.

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2026-1405

Affected Products

Slider Future

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-1405 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/34b52ca2-c05f-49b7-846f-a67136d7d379?source=cve · Note
• https://twitter.com/MNovofastovsky/status/2030993756837892462 · Twitter Post
• https://twitter.com/CveTodo/status/2024544290295132559 · Twitter Post
• https://twitter.com/MNovofastovsky/status/2030652184023495032 · Twitter Post
• https://twitter.com/CVEnew/status/2025892074936062290 · Twitter Post
• https://twitter.com/0dayPublishing/status/2024347032496783661 · Twitter Post
• https://plugins.trac.wordpress.org/browser/slider-future/tags/1.0.5/slider-future.php#L177 · Note
• https://twitter.com/geng_zast/status/2023805685058895898 · Twitter Post