PT-2026-38255 · WordPress · Slider Revolution

H0Xilo · CVE-2026-6692 · Published 2026-05-06 · Updated 2026-05-14

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Slider Revolution versions 7.0.0 through 7.0.10

Description Insufficient file type validation in the get media url() and check file path() functions allows authenticated attackers with subscriber-level access or higher to perform an Arbitrary File Upload. This flaw enables the upload of executable files, which can lead to remote code execution (the ability to run arbitrary commands on the server).

Recommendations Update to version 7.0.11.

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2026-6692

Affected Products

Slider Revolution

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-6692 · Security Note
• https://sliderrevolution.com · Note
• https://t.me/CVEtracker/52953 · Telegram Post
• https://reddit.com/r/StopBadBots/comments/1t5mr5m/stop_what_youre_doing_and_patch_slider_revolution · Reddit Post
• https://wordfence.com/threat-intel/vulnerabilities/id/a2e802a6-d2f1-47cc-883a-89110e569168?source=cve · Note
• https://twitter.com/threatintel/status/2054902216746578115 · Twitter Post
• https://twitter.com/KaitanSecurity/status/2052282290806403142 · Twitter Post
• https://twitter.com/CVEnew/status/2052400809795809306 · Twitter Post