Executive brief
The Slider by 10Web WordPress plugin (versions 1.2.62 and earlier) contains a cross-site request forgery (CSRF) flaw that allows attackers to trick logged-in administrators into performing unintended actions such as deleting files or modifying plugin settings. An attacker would need to craft a malicious webpage or link to exploit this vulnerability; a user simply visiting the page while logged into WordPress would unknowingly trigger the action. This could lead to unauthorized plugin modifications, data loss, or website compromise without requiring the attacker to obtain login credentials.
Technical details
The vulnerability is a cross-site request forgery (CSRF) affecting the Slider by 10Web WordPress plugin in versions 1.2.62 and earlier. The plugin fails to properly validate CSRF nonces on sensitive admin actions, allowing an unauthenticated attacker to craft a malicious request that, when clicked or visited by a logged-in administrator, executes unintended actions without their knowledge. Attack vectors include arbitrary file deletion and potentially other administrative operations. The exploit requires user interaction (the admin must click a malicious link or visit a crafted webpage while authenticated), and no official patch has been released as of the publication date. Mitigation involves updating the plugin to a version beyond 1.2.62 or disabling the plugin until a patch becomes available.
Affected products
- 10Web Slider <= 1.2.62
Timeline
- 2026-07-09: disclosed: Vulnerability reported to Patchstack
- 2026-08-18: advisory: Patchstack published advisory and early warning issued