CVE-2026-9050
Unauthorized Plugin Deactivation in Slider Revolution
Publication date: 2026-06-02
Last updated on: 2026-06-02
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| slider_revolution | slider_revolution | From 6.0.0 (inc) to 6.7.56 (exc) |
| slider_revolution | slider_revolution | From 7.0.0 (inc) to 7.0.15 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability exists in the Slider Revolution plugin for WordPress versions 6.0.0-6.7.55 and 7.0.0-7.0.14. It allows authenticated users with Contributor-level access or higher to modify data without proper authorization checks. Specifically, these users can deactivate any active plugin installed on the WordPress site because the plugin does not properly verify user permissions before allowing such actions.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing users with relatively low privileges (Contributor-level and above) to deactivate any active plugin on your WordPress site. This could disrupt site functionality, reduce security if security-related plugins are disabled, and potentially lead to further exploitation or downtime.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows authenticated attackers with Contributor-level access and above to deactivate any active plugin installed on the site due to improper authorization checks.
While the CVE description does not explicitly mention compliance with standards such as GDPR or HIPAA, unauthorized modification of data and potential disruption of security controls (like deactivating security plugins) could indirectly impact compliance by increasing the risk of data breaches or loss of data integrity.
However, no direct information is provided about the specific effects on compliance with these regulations.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability allows authenticated users with Contributor-level access and above to deactivate any active plugin on the site due to improper authorization checks.
Immediate mitigation steps include restricting user roles to trusted users only and limiting Contributor-level access.
Additionally, updating the Slider Revolution plugin to a version later than 7.0.14 or 6.7.55 (whichever applies) once a patch is available is recommended to fix the vulnerability.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability affects the Slider Revolution plugin for WordPress in versions 6.0.0-6.7.55 and 7.0.0-7.0.14. Detection involves identifying if these vulnerable versions are installed on your WordPress site.
You can check the installed version of the Slider Revolution plugin by accessing your WordPress admin dashboard under Plugins, or by inspecting the plugin files directly.
From the command line, if you have access to the server, you can use commands to find the plugin version, for example:
- Navigate to the WordPress plugins directory, usually wp-content/plugins/slider-revolution/.
- Use a command like `grep 'Version:' slider-revolution.php` or check the plugin's main PHP file header to find the version number.
- Alternatively, use WP-CLI (WordPress command line interface) with the command: `wp plugin get slider-revolution --field=version` to retrieve the installed version.
If the version falls within the vulnerable ranges (6.0.0-6.7.55 or 7.0.0-7.0.14), your system is potentially affected.
Network detection of exploitation attempts is difficult due to the nature of the vulnerability (unauthorized modification by authenticated users with Contributor-level access or higher). Monitoring for unusual plugin deactivation events or changes in plugin status in WordPress logs may help detect exploitation.