CVE-2026-6692

The Slider Revolution plugin for WordPress is vulnerable to Arbitrary File Upload in versions 7.0.0 to 7.0.10 via the '_get_media_url' and '_check_file_path' function. This is due to insufficient file type validation. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. The vulnerability was partially patched in version 7.0.10 and fully patched in version 7.0.11.

• CWE-434

• https://www.sliderrevolution.com/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/a2e802a6-d2f1-47cc-883a-89110e569168?source=cve

Published

May 7, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-6691The MongoDB C Driver's Cyrus SASL integration performs unsaf…8.6
• CVE-2026-66913Lookyloo did not enforce limits on the decompressed size of …6.9
• CVE-2026-66914Joomla Extension - seblod.com - Unauthenticated path travers…9.2
• CVE-2026-66915Joomla Extension - fabrikar.com - Remote code execution in F…10
• CVE-2026-66918Pivotick fails to sanitize attacker-controlled SVG markup su…8.2
• CVE-2026-66919Pivotick contains a cross-site scripting vulnerability in th…6.9
• CVE-2026-66920Pivotick contains an uncontrolled-recursion vulnerability wh…8.2
• CVE-2026-66921Pivotick’s Markdown node-reference renderer failed to HTML-e…6.3
• CVE-2026-66922Pivotick used plain JavaScript objects as lookup tables inde…5.1
• CVE-2026-6694A flaw was found in GIMP's file-png plugin. A remote attacke…5.5
• CVE-2026-6695A flaw was found in GIMP. A remote attacker could exploit th…5.5
• CVE-2026-6696The Zingaya Click-to-Call plugin for WordPress is vulnerable…6.1