Slider Revolution WordPress Plugin Arbitrary File Upload Vulnerability Allowing Remote Code Execution

A vulnerability allowing arbitrary file upload has been identified in the Slider Revolution plugin for WordPress, affecting versions 7.0.0 to 7.0.10. The issue arises from inadequate file type validation in the '_get_media_url' and '_check_file_path' functions. This vulnerability enables authenticated attackers with subscriber-level access and above to upload potentially executable files, leading to remote code execution. While the vulnerability was partially addressed in version 7.0.10, it was fully resolved in version 7.0.11.

Impact

Exploitation of this vulnerability allows for arbitrary file upload, with the potential for uploaded files to be executed on the server, leading to remote code execution.

Remediation

Users are advised to update the Slider Revolution WordPress plugin to version 7.0.11 or a newer patched version.