CVE-2026-66635 Overview
CVE-2026-66635 is an unauthenticated Cross-Site Request Forgery (CSRF) vulnerability affecting the Slider by 10Web WordPress plugin in versions 1.2.62 and earlier. The flaw allows an attacker to trick an authenticated administrator into triggering unintended state-changing requests, leading to arbitrary file deletion on the WordPress installation. The vulnerability is tracked under CWE-352 and requires user interaction to succeed. Exploitation abuses missing or insufficient CSRF token validation on privileged plugin actions.
Critical Impact
A successful CSRF attack against an authenticated administrator can delete arbitrary files on the WordPress host, resulting in site availability loss and potential compromise of the underlying application state.
Affected Products
- Slider by 10Web WordPress plugin, versions <= 1.2.62
- WordPress sites running the slider-wd plugin
- Any hosting environment with the vulnerable plugin installed and an authenticated admin session
Discovery Timeline
- 2026-08-18 - CVE-2026-66635 published to NVD
- 2026-08-20 - Last updated in NVD database
Technical Details for CVE-2026-66635
Vulnerability Analysis
The Slider by 10Web plugin exposes privileged actions without adequate CSRF protection. An attacker crafts a malicious page or link that submits a forged request to the vulnerable plugin endpoint. When a logged-in WordPress administrator visits the attacker-controlled resource, the browser sends the request with valid session cookies, and the plugin performs the requested action. The plugin does not verify the request originated from an intended workflow, allowing arbitrary file deletion via the admin's authenticated context.
The attack vector is network-based and requires user interaction, but no attacker credentials are needed. The scope changes because the vulnerable component acts on files outside the plugin's expected boundary. Impact is limited to availability, with no direct confidentiality or integrity loss reported. Refer to the Patchstack advisory for technical specifics.
Root Cause
The root cause is missing or improperly validated anti-CSRF nonces on state-changing plugin endpoints. WordPress provides wp_nonce_field() and check_admin_referer() primitives for CSRF protection, but the affected plugin versions do not consistently enforce nonce verification on file-deletion handlers.
Attack Vector
An attacker hosts a malicious page containing an auto-submitting form or image tag that points at the vulnerable plugin endpoint. The attacker then delivers the link through phishing, forum posts, or comment fields. When the target administrator loads the page while authenticated to WordPress, the browser attaches the session cookie and the request executes with admin privileges, deleting attacker-specified files.
No verified public exploit code is available at the time of publication. The technical mechanism is described in the Patchstack advisory.
Detection Methods for CVE-2026-66635
Indicators of Compromise
- Unexpected file deletions within the WordPress installation directory, particularly plugin, theme, or uploads paths
- WordPress admin requests to slider-wd plugin endpoints originating from external Referer headers
- Administrator sessions performing file operations shortly after visiting untrusted external sites
Detection Strategies
- Inspect web server access logs for POST or GET requests to slider-wd admin actions with off-site Referer values
- Monitor WordPress wp-admin/admin-ajax.php and admin-post.php traffic for missing or malformed nonce parameters
- Correlate file deletion events on the web root with administrator HTTP activity to identify CSRF-driven operations
Monitoring Recommendations
- Enable file integrity monitoring on wp-content/ directories to alert on unauthorized deletions
- Log all administrator actions in the WordPress plugin and review for anomalies against expected workflows
- Alert on WordPress admin traffic where the Referer header points to domains outside the site's own host
How to Mitigate CVE-2026-66635
Immediate Actions Required
- Update the Slider by 10Web plugin to a version later than 1.2.62 as soon as a patched release is available
- Restrict administrator browsing habits by isolating admin sessions from general web browsing
- Audit wp-content/ for missing files and restore from backup where deletion is detected
Patch Information
Refer to the Patchstack advisory for CVE-2026-66635 for vendor patch status. Apply the fixed plugin release through the WordPress admin dashboard or via wp-cli once available.
Workarounds
- Deactivate the Slider by 10Web plugin until a patched version is installed
- Deploy a Web Application Firewall (WAF) rule that blocks requests to plugin endpoints lacking a valid WordPress nonce
- Enforce SameSite=Lax or SameSite=Strict cookie attributes on the WordPress session cookie to reduce cross-origin request risk
# Disable the vulnerable plugin via wp-cli until patched
wp plugin deactivate slider-wd
# Verify current plugin version
wp plugin get slider-wd --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
