CVE-2024-35722: Slider Responsive Slideshow Auth Bypass

CVE-2024-35722 Overview

CVE-2024-35722 is a Missing Authorization vulnerability [CWE-862] affecting the A WP Life Slider Responsive Slideshow – Image slider, Gallery slideshow WordPress plugin. The flaw impacts all plugin versions up to and including 1.4.0. An authenticated attacker with low privileges can invoke plugin functionality without the proper capability checks, leading to broken access control across confidentiality, integrity, and availability.

The vulnerability is network-exploitable and requires only low-privileged access. Any authenticated WordPress user, including subscribers, may be positioned to abuse plugin endpoints that lack authorization enforcement.

Critical Impact
Low-privileged WordPress users can invoke privileged plugin actions, enabling manipulation of slider content, plugin settings, or associated data on affected sites.

Affected Products

A WP Life Slider Responsive Slideshow – Image slider, Gallery slideshow plugin for WordPress
All versions from n/a through 1.4.0
WordPress installations with the vulnerable plugin activated

Discovery Timeline

2024-06-10 - CVE-2024-35722 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-35722

Vulnerability Analysis

The vulnerability is a Missing Authorization flaw classified under [CWE-862]. The plugin exposes one or more actions that perform sensitive operations without verifying that the calling user holds the necessary WordPress capability. Because the plugin does not enforce authorization checks server-side, requests reach privileged code paths regardless of the caller's role.

An attacker who holds any authenticated session on the target site can call the affected endpoints directly. The consequence is broken access control against slider data and plugin configuration, with impact on data integrity, confidentiality of managed assets, and site availability where the abused functionality can alter or remove content.

Root Cause

The root cause is the absence of current_user_can() capability checks, and likely missing nonce verification via check_ajax_referer() or wp_verify_nonce(), on plugin handlers. WordPress plugins must explicitly gate privileged AJAX or admin-post actions; when these gates are missing, any logged-in user can trigger the handler.

Attack Vector

Exploitation requires network access to the WordPress site and a low-privileged authenticated account. No user interaction is needed. The attacker submits a crafted HTTP request to the vulnerable plugin action, for example via admin-ajax.php, and the handler executes without validating the caller's role. See the Patchstack Vulnerability Database Entry for advisory details.

Detection Methods for CVE-2024-35722

Indicators of Compromise

Unexpected creation, modification, or deletion of slider entries and gallery items managed by the plugin.
Requests to wp-admin/admin-ajax.php referencing Slider Responsive Slideshow actions originating from low-privilege user sessions.
Changes to plugin settings or uploaded media without corresponding administrator activity in the WordPress audit trail.

Detection Strategies

Inventory WordPress deployments and flag any installation running Slider Responsive Slideshow version 1.4.0 or earlier.
Review web server access logs for POST requests to plugin AJAX handlers correlated with non-administrator authentication cookies.
Compare current slider configuration against known-good backups to identify unauthorized modifications.

Monitoring Recommendations

Enable a WordPress activity log plugin to record capability-relevant actions and user role context for every request.
Monitor for anomalous spikes in admin-ajax.php traffic from subscriber or contributor accounts.
Alert on plugin file changes and configuration writes outside standard maintenance windows.

How to Mitigate CVE-2024-35722

Immediate Actions Required

Update the Slider Responsive Slideshow plugin to the latest available version that addresses this vulnerability, per the vendor advisory.
If no fixed version is available, deactivate and remove the plugin until a patch is published.
Audit WordPress user accounts and revoke unnecessary low-privilege access to reduce the pool of potential attackers.

Patch Information

The vulnerability affects Slider Responsive Slideshow versions up to and including 1.4.0. Consult the Patchstack Vulnerability Database Entry for the current fixed version and vendor guidance. Apply the vendor-supplied update through the WordPress plugin management console.

Workarounds

Restrict access to wp-admin/admin-ajax.php for unauthenticated and low-privilege sessions using a web application firewall rule targeting the vulnerable action names.
Disable open user registration on the WordPress site to reduce the population of low-privileged accounts that can reach the vulnerable code path.
Enforce least privilege on existing accounts and remove dormant subscriber, contributor, or author users.

bash

# Configuration example: disable open registration and remove the plugin
wp option update users_can_register 0
wp plugin deactivate slider-responsive-slideshow
wp plugin delete slider-responsive-slideshow