Executive brief
Slider Revolution, a popular WordPress plugin for creating visual content, contains a security flaw that allows low-level users to access sensitive server files. By exploiting a design error in how the plugin handles image imports, an attacker with a basic account can copy private files—such as configuration files, database backups, or security keys—into a public folder where they can be downloaded. This could lead to a full site takeover if sensitive credentials or database information are exposed.
Technical details
The vulnerability arises from three compounding flaws: a leaked AJAX nonce to all authenticated users, an allowlisted action that bypasses administrator-only checks, and a failure to restrict the 'url' parameter to remote protocols in the create_wordpress_image_from_url() function. Because the plugin uses path_or_url_exists() and @copy() without verifying if the source is a local filesystem path, authenticated attackers (Subscriber level and above) can force the server to copy local files into a publicly accessible directory. The exploit is further facilitated by a weak extension blacklist that fails to block sensitive file types like .sql, .pem, and .conf, and a MIME type check that relies on attacker-supplied input. Users should update to a version beyond 7.0.10.
Affected products
- ThemePunch Slider Revolution up to and including 7.0.10
Timeline
- 2026-06-09: disclosed
- 2026-06-09: advisory