Slider Revolution 7.0.0-7.0.10 Vulnerability (CVE-2026-6692) – Authenticated Arbitrary File Upload and RCE

On April 18, 2026, Wordfence reported a high‑severity (CVSS 8.8) vulnerability in Slider Revolution 7.0.0‑7.0.10 that allows authenticated users with subscriber‑level access to upload arbitrary files via the _get_media_url endpoint, leading to remote code execution. The flaw stems from insufficient file‑type validation in the _check_file_path function, which writes attacker‑supplied files to the uploads directory without checking extensions. Wordfence issued a firewall rule on April 20, 2026, protecting premium and Care users immediately, while free users received the same rule on May 20, 2026. ThemePunch released the first patch (7.0.11) on April 22, 2026, followed by a second patch on May 4, 2026, and the plugin now fully mitigates the issue.

An estimated 45,000 of the 5 million+ Slider Revolution installations were vulnerable, and the researcher h0xilo earned a $4,914 bounty for discovering the flaw. The CVE‑ID is CVE‑2026‑6692, and the affected range is 7.0.0‑7.0.10. The vulnerability was partially addressed in 7.0.10 but required the 7.0.11 release for a complete fix. All WordPress sites using Slider Revolution should update to 7.0.11 as soon as possible to eliminate the RCE risk.