CVE-2025-8418: B Slider WordPress Plugin RCE Vulnerability

CVE-2025-8418 Overview

CVE-2025-8418 affects the B Slider- Gutenberg Slider Block for WP plugin for WordPress in all versions up to and including 1.1.30. The vulnerability stems from missing capability checks on the activated_plugin function in adminMenu.php. Authenticated attackers with subscriber-level access or above can install arbitrary plugins on the target server. Installing an attacker-controlled plugin enables remote code execution on the underlying WordPress host. This issue is classified under CWE-862: Missing Authorization.

Critical Impact
Subscriber-level WordPress accounts can install arbitrary plugins, leading to full remote code execution on affected sites.

Affected Products

B Slider- Gutenberg Slider Block for WP plugin for WordPress, versions <= 1.1.30
WordPress sites permitting subscriber registrations using the affected plugin
All hosting environments running the vulnerable plugin code path in adminMenu.php

Discovery Timeline

2025-08-12 - CVE-2025-8418 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-8418

Vulnerability Analysis

The B Slider plugin exposes a plugin installation handler through the activated_plugin function defined in adminMenu.php. The function performs the privileged action of installing and activating plugins but does not call WordPress capability checks such as current_user_can('install_plugins'). Any authenticated user, including the lowest-privilege subscriber role, can invoke the handler. The handler then downloads and installs an arbitrary plugin specified by the attacker. Once the plugin is active, its PHP code executes within the WordPress application context, granting the attacker arbitrary code execution. The Wordfence advisory and the WordPress.org plugin trac confirm the fix was applied via changeset 3342079. See the WordPress Plugin Code Review for the vulnerable line.

Root Cause

The root cause is missing authorization [CWE-862]. The activated_plugin callback trusts the AJAX or admin-post request without verifying the caller's WordPress role or capability. WordPress requires the install_plugins capability for this action, which only administrators hold by default. The plugin also does not enforce a nonce validation tied to a privileged context.

Attack Vector

The attack vector is network-based and requires only low-privilege authentication. An attacker first obtains a subscriber account on a target site, either through open registration or credential reuse. The attacker then issues a request to the vulnerable handler, supplying the slug of a malicious or backdoored plugin hosted on the WordPress plugin repository or another reachable source. The vulnerable function installs and activates the plugin, executing attacker-supplied PHP and yielding full site takeover. No user interaction is required from an administrator.

No public proof-of-concept exploit code is referenced in the advisory. For technical details, review the Wordfence Vulnerability Report and the WordPress Plugin Changeset Info.

Detection Methods for CVE-2025-8418

Indicators of Compromise

Unexpected plugins appearing under wp-content/plugins/ that were not installed by an administrator.
WordPress audit log entries showing activated_plugin events triggered by subscriber or contributor accounts.
HTTP POST requests to admin-ajax.php or admin-post endpoints associated with the B Slider plugin from non-admin sessions.
New PHP files with recent modification timestamps in wp-content/plugins/ directories, particularly webshells or obfuscated loaders.

Detection Strategies

Inspect web server access logs for requests targeting B Slider admin endpoints originating from low-privilege authenticated sessions.
Monitor the WordPress options table and active_plugins entry for unauthorized additions.
Compare installed plugin inventory against an approved baseline and alert on drift.

Monitoring Recommendations

Enable file integrity monitoring on wp-content/plugins/ to detect unauthorized plugin directories.
Forward WordPress audit logs to a centralized SIEM and alert on plugin install or activation events tied to non-administrator users.
Track outbound HTTP requests from the WordPress host to the WordPress.org plugin repository, which indicate plugin downloads.

How to Mitigate CVE-2025-8418

Immediate Actions Required

Update the B Slider- Gutenberg Slider Block for WP plugin to a version newer than 1.1.30 containing changeset 3342079.
Audit all installed plugins and remove any that were not authorized by an administrator.
Force password resets for all subscriber and contributor accounts and review recent user registrations.
Disable open user registration on sites that do not require it by setting users_can_register to 0.

Patch Information

The vendor remediated the issue in the WordPress plugin trunk via changeset 3342079. Review the WordPress Plugin Changeset Info for the corrected adminMenu.php source. Apply the latest plugin release available through the WordPress plugin updater.

Workarounds

Deactivate and delete the B Slider plugin until a patched version is deployed.
Restrict access to wp-admin/admin-ajax.php and wp-admin/admin-post.php for non-administrator sessions using a web application firewall rule.
Set DISALLOW_FILE_MODS to true in wp-config.php to block plugin installation entirely from the web interface.

bash

# Configuration example: disable plugin and theme installation via wp-config.php
define( 'DISALLOW_FILE_MODS', true );

# WP-CLI commands to deactivate and remove the vulnerable plugin
wp plugin deactivate b-slider
wp plugin delete b-slider

# Disable open user registration
wp option update users_can_register 0