UpHeron
All vulnerabilities

Servers and applications · WordPress plugins

CVE-2023-2359

Slider Revolution: Code Injection

Severity
High 8.8
Published
22 May 2023
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Fixed in
6.6.13
Also known as
WPV-d998f79e6fbf
Sources
NVD, WPVulnerability

Description

The Slider Revolution WordPress plugin through 6.6.12 does not check for valid image files upon import, leading to an arbitrary file upload which may be escalated to Remote Code Execution in some server configurations.

Affected software

SoftwareAffected versions
Slider RevolutionServers and applications · cpe:a:themepunch:slider_revolution
  • Every version up to 6.6.12
Slider RevolutionWordPress plugins · wp-plugin:revslider
  • Every version before 6.6.13

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-2359
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-2359
  • Wordfence https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/revslider/slider-revolution-6612-authenticated-administrator-arbitrary-file-upload