CVE-2026-1405
Awaiting Analysis Awaiting Analysis - Queue

Arbitrary File Upload in Slider Future Plugin Enables RCE

Publication date: 2026-02-19

Last updated on: 2026-02-19

Assigner: Wordfence

Description
The Slider Future plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'slider_future_handle_image_upload' function in all versions up to, and including, 1.0.5. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-02-19
Last Modified
2026-02-19
Generated
2026-07-06
AI Q&A
2026-02-19
EPSS Evaluated
2026-07-04
NVD
CVE-2026-1405
EUVD
EUVD-2026-8115

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
slider_future slider_future to 1.0.5 (inc)
slider_future slider_future_plugin to 1.0.5 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Slider Future plugin for WordPress has a vulnerability in its 'slider_future_handle_image_upload' function where it does not properly validate the type of files being uploaded. This flaw exists in all versions up to and including 1.0.5.

Because of this missing file type validation, an unauthenticated attacker can upload arbitrary files to the server hosting the affected WordPress site.

This arbitrary file upload can potentially lead to remote code execution on the server.

Impact Analysis

This vulnerability can have severe impacts including allowing attackers to upload malicious files without authentication.

Such unauthorized file uploads can lead to remote code execution, meaning attackers could run arbitrary code on your server.

This could result in full compromise of the affected website, data breaches, defacement, or use of the server for further attacks.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

I don't know

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-1405. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart