A critical arbitrary file upload vulnerability in the Slider Revolution plugin for WordPress allows authenticated attackers with subscriber-level access to achieve remote code execution.

This flaw stems from CWE-434, representing an unrestricted upload of a file with a dangerous type due to insufficient file type validation in the _get_media_url and _check_file_path functions, requiring subscriber-level authentication.

A successful exploit of this vulnerability could lead to total system compromise, including unauthorized remote code execution, sensitive data theft, and complete administrative takeover of the underlying WordPress installation. This risk is justified by a high CVSS score of 8.8, reflecting the severe impact on confidentiality, integrity, and availability.

Immediate Action: Update the Slider Revolution plugin to version 7.0.11 or later to fully resolve the file upload validation flaw.

Proactive Monitoring: Monitor server access logs and file system integrity for newly created executable files within media upload directories or unexpected script execution.

Compensating Controls: Deploy a Web Application Firewall rule to inspect file upload requests and block suspicious file extensions originating from low-privileged user accounts.

Public Exploit Available: false

Given the high CVSS score and the severe impact of remote code execution, organizations utilizing the Slider Revolution plugin must prioritize updating to version 7.0.11 immediately. Security teams should also audit existing subscriber accounts to ensure principle of least privilege is strictly enforced across the WordPress environment.