Vulnerability · Published Jun 19, 2023 · Assigned by WPScan
CVE-2023-2359Revolution Slider <= 6.6.12 - Author+ Remote Code Execution
High 8.8
In plain English
A high-severity security flaw in Slider Revolution from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 2.5% (higher than 85% of all known vulnerabilities).
Severity (CVSS NVD)8.8High
Exploit odds (30 days)2.5%top 14.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
The Slider Revolution WordPress plugin through 6.6.12 does not check for valid image files upon import, leading to an arbitrary file upload which may be escalated to Remote Code Execution in some server configurations.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Slider Revolution | 0 – through 6.6.12 |
References
- https://wpscan.com/vulnerability/a8350890-e6d4-4b04-a158-2b0ee3748e65 exploit, vdb-entry, technical-description
- https://wpscan.com/vulnerability/a8350890-e6d4-4b04-a158-2b0ee3748e65/ exploit