CVE-2023-6528

Published Jan 8, 2024

Last updated 10 months ago

Overview

Description: The Slider Revolution WordPress plugin before 6.6.19 does not prevent users with at least the Author role from unserializing arbitrary content when importing sliders, potentially leading to Remote Code Execution.
Source: contact@wpscan.com
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Primary
Base score: 8.8
Impact score: 5.9
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

nvd@nist.gov: CWE-502

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:themepunch:slider_revolution:*:*:*:*:*:wordpress:*:*",
            "vulnerable": true,
            "matchCriteriaId": "2B541D44-9905-4798-9926-9ED3F69506AF",
            "versionEndExcluding": "6.6.19"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References