CVE-2024-34444: Slider Revolution Auth Bypass Flaw

CVE-2024-34444 Overview

CVE-2024-34444 is a Missing Authorization vulnerability [CWE-862] affecting the ThemePunch OHG Slider Revolution plugin for WordPress. The flaw impacts all versions prior to 6.7.0 and stems from broken access control on plugin endpoints that fail to verify user permissions before performing sensitive actions. Attackers can reach the vulnerable functionality over the network without authentication, though successful exploitation requires user interaction. According to vendor advisories from Patchstack, the access control gap is linked to an unauthenticated cross-site scripting (XSS) condition, enabling script injection against site visitors and administrators.

Critical Impact

Unauthenticated attackers can abuse missing authorization checks in Slider Revolution to trigger cross-site scripting, leading to session theft, privileged account compromise, and full site takeover.

Affected Products

• ThemePunch Slider Revolution WordPress plugin versions prior to 6.7.0
• WordPress sites with the Slider Revolution (revslider) plugin installed and active
• Themes and page builders bundling vulnerable Slider Revolution versions

Discovery Timeline

• 2024-06-19 - CVE-2024-34444 published to the National Vulnerability Database
• 2026-04-28 - Last updated in the NVD database

Technical Details for CVE-2024-34444

Vulnerability Analysis

The vulnerability is a Missing Authorization weakness [CWE-862] in the Slider Revolution plugin. The plugin exposes one or more action handlers that perform privileged operations without verifying that the caller has the required capability or nonce. Because the endpoint is reachable by unauthenticated requests, any visitor can invoke functionality intended for administrators or editors.

Patchstack advisories indicate the broken access control path also enables an unauthenticated stored or reflected XSS condition. An attacker can inject JavaScript that executes in the browser of an administrator who later interacts with the affected page or admin view. Execution in an authenticated administrator context allows the attacker to perform actions on behalf of that user, including creating accounts, modifying plugins, or pivoting to remote code execution through theme or plugin editing.

Root Cause

The root cause is the absence of capability and nonce checks in plugin AJAX or REST handlers. The code path executes sensitive operations based solely on the request reaching the endpoint, rather than confirming that current_user_can() returns true for an appropriate capability and that a valid nonce accompanies the request.

Attack Vector

Exploitation occurs over the network against the WordPress site hosting the vulnerable plugin. The attacker crafts a request to the unprotected plugin endpoint, supplying payload data that the plugin stores or reflects without proper sanitization or authorization. When a privileged user interacts with the affected resource, the injected script runs in their browser context, completing the attack chain.

No public proof-of-concept exploit is currently listed in Exploit-DB, and the issue is not present on the CISA Known Exploited Vulnerabilities list. Technical details are documented in the Patchstack XSS Vulnerability Patch advisory and the Patchstack broken access control entry.

Detection Methods for CVE-2024-34444

Indicators of Compromise

• Unauthenticated POST or GET requests to Slider Revolution AJAX actions such as those handled under admin-ajax.php?action=revslider_* from external IP addresses.
• New or modified slider entries, slides, or custom CSS containing <script> tags, javascript: URIs, or event handlers like onerror= and onload=.
• Unexpected administrator account creations or plugin installations following access to slider editing pages.
• Outbound requests from administrator browsers to attacker-controlled domains shortly after visiting WordPress admin pages.

Detection Strategies

• Inspect web server access logs for unauthenticated requests targeting Slider Revolution endpoints and correlate with response codes indicating successful processing.
• Deploy a Web Application Firewall (WAF) rule set that flags script payloads and unusual parameters submitted to revslider actions.
• Run file integrity monitoring against the wp-content/plugins/revslider/ directory and against the WordPress options table where slider configurations are stored.

Monitoring Recommendations

• Forward WordPress, web server, and WAF logs to a centralized analytics platform and alert on anomalous administrative actions originating from low-reputation IPs.
• Monitor for the creation of new administrator users, role changes, and modifications to active plugins or themes outside of approved change windows.
• Track outbound network connections from administrator workstations following access to WordPress admin URLs to identify post-XSS callbacks.

How to Mitigate CVE-2024-34444

Immediate Actions Required

• Upgrade Slider Revolution to version 6.7.0 or later on every WordPress site that uses the plugin, including sites where it is bundled with a theme.
• Audit administrator accounts, application passwords, and recently installed plugins for unauthorized changes introduced before patching.
• Rotate WordPress administrator credentials and invalidate active sessions if exploitation is suspected.

Patch Information

ThemePunch resolved the issue in Slider Revolution 6.7.0 by adding the missing authorization and input validation logic. Refer to the Patchstack advisory on the Slider Revolution XSS patch for vendor-confirmed fix details and the Patchstack vulnerability database entry for affected version ranges.

Workarounds

• Place the WordPress site behind a WAF that blocks unauthenticated requests to admin-ajax.php actions associated with Slider Revolution until the plugin is updated.
• Temporarily deactivate the Slider Revolution plugin on sites that cannot upgrade immediately, and remove the plugin if it is not in active use.
• Restrict access to /wp-admin/ and admin-ajax.php by IP allow-listing where feasible to reduce exposure during the patch window.

# Configuration example: WP-CLI commands to update or disable Slider Revolution
wp plugin update revslider --version=6.7.0
wp plugin status revslider
# If immediate update is not possible, deactivate the plugin
wp plugin deactivate revslider