An authenticated attacker with subscriber-level access can achieve remote code execution on WordPress sites using vulnerable versions of the bSlider plugin.

The vulnerability arises from missing authorization checks (CWE-862) within the activated_plugin function. This flaw allows any authenticated user, including those with minimal subscriber-level permissions, to install arbitrary plugins, effectively granting full site control and the ability to execute remote code.

The ability for a low-privileged user to install arbitrary plugins represents a critical security failure, as it grants an attacker complete control over the WordPress environment. This risk, justified by a high CVSS score of 8.8, could result in total data compromise, permanent site defacement, and the installation of backdoors for persistent unauthorized access.

Immediate Action: Update the bSlider plugin to the most recent version available from the official WordPress repository to address the missing authorization checks.

Proactive Monitoring: Review WordPress administrative logs for unexpected plugin installations or activations performed by non-administrative user accounts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block unauthorized plugin activation requests or suspicious administrative API calls.

Public Exploit Available: Yes, a public proof-of-concept exists via a GitHub repository.

Given the potential for remote code execution via arbitrary plugin installation, this vulnerability poses a severe threat to WordPress infrastructure. Administrators must prioritize updating the bSlider plugin immediately. If an update is not currently feasible, the plugin should be deactivated or removed from the environment until a verified secure version is deployed.