Slivery Extender <= 1.0.2 - Authenticated(Contributor+) Remote Code Execution via shortcode
highThe Slivery Extender plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.0.2 via the 'slider_theme_section' function. This is due to the use of call_user_func on one of the shortcode attributes. This makes it possible for authenticated attackers, with contributor access a...
- CVSS:
- 8.8
- Affected:
- up to 1.0.2
- Fixed in:
- 1.0.3
- Disclosed:
- Feb 26, 2024