Unauthorized Data Access in Slider Revolution Plugin for WordPress
CVE-2025-10249

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
Slider Revolution
Vendor
CVE Published:
9 October 2025

What is CVE-2025-10249?

The Slider Revolution plugin for WordPress is exposed to a vulnerability that allows authenticated attackers with Contributor-level access and above to perform unauthorized actions. Due to a lack of proper capability checks on several critical functions, these attackers can install and activate add-ons, create new sliders, and download arbitrary files, potentially leading to significant security risks for affected WordPress sites. This issue affects all versions of the plugin up to and including version 6.7.37.

Affected Version(s)

Slider Revolution * <= 6.7.37

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://www.sliderrevolution.com/documentation/changelog/

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Matthew Rollings
JSON
.
CVE-2025-10249 : Unauthorized Data Access in Slider Revolution Plugin for WordPress