Vulnerability · Published Jun 1, 2026 · Assigned by Wordfence
CVE-2026-9050Slider Revolution 6.0.0-6.7.55 and 7.0.0-7.0.14 - Missing Authorization to Authenticated (Contributor+) Arbitrary Plugin Deactivation
Medium 4.3
In plain English
A medium-severity missing authorization in Slider Revolution from Revolution Slider. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities).
Official description
The Slider Revolution plugin for WordPress in versions 6.0.0-6.7.55 and 7.0.0-7.0.14 is vulnerable to unauthorized modification of data. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with Contributor-level access and above, to deactivate any active plugin installed on the site.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Revolution Slider | Slider Revolution | 6.0.0 – through 6.7.557.0.0 – through 7.0.14 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N