CVE-2026-6692: Slider Revolution WordPress RCE Vulnerability

CVE-2026-6692 Overview

CVE-2026-6692 is an arbitrary file upload vulnerability in the Slider Revolution plugin for WordPress. The flaw affects versions 7.0.0 through 7.0.10 and stems from insufficient file type validation in the _get_media_url and _check_file_path functions. Authenticated attackers with subscriber-level access or higher can upload executable files, enabling remote code execution on the underlying server. The issue was partially patched in version 7.0.10 and fully resolved in version 7.0.11. The weakness is classified as CWE-434: Unrestricted Upload of File with Dangerous Type.

Critical Impact

A subscriber-level account is sufficient to upload arbitrary files and achieve remote code execution on affected WordPress sites.

Affected Products

• Slider Revolution plugin for WordPress versions 7.0.0 through 7.0.10
• WordPress sites with the plugin installed and any user account at subscriber level or above
• Sites that received only the partial fix in 7.0.10 without upgrading to 7.0.11

Discovery Timeline

• 2026-05-07 - CVE-2026-6692 published to NVD
• 2026-05-07 - Last updated in NVD database

Technical Details for CVE-2026-6692

Vulnerability Analysis

The Slider Revolution plugin exposes media handling routines through the _get_media_url and _check_file_path functions. These functions process file paths and URLs supplied during upload operations but fail to enforce strict validation on the file type or extension. An authenticated user can leverage this gap to place executable files inside the WordPress directory tree.

Once an attacker uploads a PHP file or another server-executable artifact, requesting that file through the web server triggers code execution under the WordPress process context. This grants the attacker the same privileges as the web server, typically allowing database access, theme and plugin modification, and lateral movement.

The vendor released a partial fix in version 7.0.10 that did not fully eliminate the unsafe code path. Version 7.0.11 contains the complete fix.

Root Cause

The root cause is missing or insufficient file type validation in the _get_media_url and _check_file_path functions. The functions accept file inputs without verifying the extension, MIME type, or magic bytes against an allowlist of safe media types. This matches the CWE-434 pattern of unrestricted upload of file with dangerous type.

Attack Vector

Exploitation requires network access to the WordPress site and a valid authenticated session at subscriber level or higher. Subscriber accounts can be created on any WordPress site that allows open registration, lowering the barrier significantly. The attacker submits an upload request that routes through the vulnerable functions and supplies a file with a server-executable extension. After upload, the attacker requests the file URL to invoke the embedded payload.

No verified exploit code is published in the referenced sources. Refer to the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-6692

Indicators of Compromise

• New .php, .phtml, or .phar files appearing under wp-content/uploads/ or Slider Revolution media directories
• Outbound network connections initiated by the web server process to unfamiliar hosts shortly after upload activity
• WordPress accounts at subscriber role created from unfamiliar IP addresses preceding upload events
• Unexpected modifications to plugin, theme, or wp-config.php files following media upload activity

Detection Strategies

• Inspect HTTP POST requests to Slider Revolution AJAX endpoints for file parameters with executable extensions
• Compare current Slider Revolution plugin version against 7.0.11 across managed WordPress instances
• Hash files in the uploads directory and flag any with PHP shebangs, <?php tags, or known webshell signatures
• Correlate subscriber-level authentication events with subsequent file write activity in plugin directories

Monitoring Recommendations

• Forward WordPress access logs and PHP-FPM logs to a centralized log platform for retention and querying
• Alert on execution of PHP files located in upload directories, which should never serve dynamic content
• Monitor file integrity for the wp-content/uploads/ tree using a host-based integrity tool
• Track creation of new low-privilege WordPress accounts and review them against legitimate registration patterns

How to Mitigate CVE-2026-6692

Immediate Actions Required

• Upgrade Slider Revolution to version 7.0.11 or later on every WordPress site where the plugin is installed
• Audit the wp-content/uploads/ directory for files with executable extensions and remove any unauthorized artifacts
• Review WordPress user accounts and disable or delete suspicious subscriber-level accounts
• Rotate WordPress administrator credentials and database passwords if compromise is suspected

Patch Information

The vendor fully patched CVE-2026-6692 in Slider Revolution version 7.0.11. Version 7.0.10 contained only a partial fix and remains vulnerable. Refer to the Slider Revolution homepage for download and update instructions and the Wordfence Vulnerability Report for advisory details.

Workarounds

• Disable the Slider Revolution plugin until the upgrade to 7.0.11 is completed
• Disable open user registration in WordPress settings to remove the subscriber-account attack path
• Configure the web server to block PHP execution within the wp-content/uploads/ directory
• Restrict access to plugin AJAX endpoints behind a web application firewall rule that blocks executable file extensions

# Apache: block PHP execution in WordPress uploads directory
# Place this .htaccess in wp-content/uploads/
<FilesMatch "\.(php|phtml|phar|php3|php4|php5|php7|phps)$">
    Require all denied
</FilesMatch>

# Nginx equivalent in server block
location ~* /wp-content/uploads/.*\.(php|phtml|phar)$ {
    deny all;
    return 403;
}