CVE-2026-14244: Jssor Slider Path Traversal Vulnerability

CVE-2026-14244 Overview

CVE-2026-14244 is a directory traversal vulnerability in the Jssor Slider by jssor.com plugin for WordPress. The flaw affects all versions up to and including 3.1.24 and stems from insufficient validation of the url parameter. Unauthenticated attackers can traverse the file system and read the contents of arbitrary files on the underlying server. Exposed files may include WordPress configuration data, credentials, and other sensitive information stored on disk. The issue is tracked under CWE-22: Improper Limitation of a Pathname to a Restricted Directory.

Critical Impact
Unauthenticated remote attackers can read arbitrary files on WordPress servers running vulnerable Jssor Slider installations, exposing secrets such as wp-config.php contents.

Affected Products

Jssor Slider by jssor.com WordPress plugin, all versions through 3.1.24
WordPress sites with the plugin installed and activated
Any hosting environment exposing the plugin's dispatcher endpoints to the internet

Discovery Timeline

2026-07-08 - CVE-2026-14244 published to the National Vulnerability Database
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-14244

Vulnerability Analysis

The vulnerability resides in the Jssor Slider admin controller and dispatcher components. Referenced source lines in class-jssor-slider-admin-controller.php and jssor-slider-dispatcher.php accept a url parameter from user-controlled HTTP input. The plugin uses this value to construct file paths without normalizing traversal sequences such as ../. As a result, an attacker can escape the intended directory and reach arbitrary paths within the web server's readable file system. The Wordfence advisory confirms the unauthenticated attack surface.

Root Cause

The root cause is missing input sanitization on the url request parameter. The plugin trusts the supplied path and passes it to file read routines without canonicalizing it or verifying that the resolved path stays within a permitted base directory. This is a textbook [CWE-22] path traversal weakness.

Attack Vector

Attackers send crafted HTTP requests to the Jssor Slider endpoints with directory traversal payloads embedded in the url parameter. Because the endpoints do not require authentication, exploitation requires only network reachability to the WordPress site. The server returns file contents in the response, allowing exfiltration of secrets and further reconnaissance. See the Wordfence report for exploitation context.

No verified proof-of-concept code is publicly linked in the CVE record. Exploitation follows the standard pattern of appending traversal sequences to the vulnerable parameter to reference sensitive files such as WordPress configuration, environment files, or SSH key material readable by the web server user.

Detection Methods for CVE-2026-14244

Indicators of Compromise

HTTP requests to Jssor Slider endpoints containing ../, ..\, URL-encoded traversal (%2e%2e%2f), or absolute paths in the url parameter.
Web server access logs showing responses containing filesystem content following requests to jssor-slider-dispatcher.php or admin controller routes.
Outbound requests referencing sensitive files such as wp-config.php, /etc/passwd, or .env.

Detection Strategies

Deploy Web Application Firewall (WAF) rules that inspect the url query parameter for path traversal patterns on requests targeting Jssor Slider endpoints.
Correlate 200-status responses with unusually large payload sizes on plugin routes that should return small metadata.
Alert on any request to plugin dispatcher scripts from unauthenticated sessions where the parameter contains dot-dot sequences or encoded variants.

Monitoring Recommendations

Enable verbose logging on the WordPress site and forward web server logs to a centralized SIEM for retention and analysis.
Track requests to Jssor Slider PHP files by URI, source IP, and parameter content to establish a baseline and identify anomalies.
Monitor filesystem access telemetry on the web server for reads of sensitive files by the PHP worker process.

How to Mitigate CVE-2026-14244

Immediate Actions Required

Disable or uninstall the Jssor Slider plugin until a vendor patch is confirmed installed.
Rotate any credentials, API tokens, or database passwords stored in files potentially readable by the web server user, including wp-config.php secrets.
Restrict access to the plugin's dispatcher endpoints via WAF rules or .htaccess deny directives.
Review web server logs for prior exploitation attempts against the url parameter.

Patch Information

At the time of publication, no fixed version of the Jssor Slider plugin has been identified in the CVE record. Review the WordPress plugin repository and the Wordfence advisory for updates and install the fixed release once available.

Workarounds

Remove the plugin from production sites and replace it with an actively maintained slider alternative.
Block requests to jssor-slider-dispatcher.php and the admin controller API paths at the reverse proxy or WAF layer.
Run the PHP process under a least-privilege account with filesystem permissions limited to the WordPress document root.

bash

# Example nginx configuration to block Jssor Slider dispatcher access
location ~* /wp-content/plugins/jssor-slider/(jssor-slider-dispatcher\.php|interface/api/) {
    deny all;
    return 403;
}