CVE-2023-6528: Slider Revolution < 6.6.19 - Author+ Insecure Deserialization leading to RCE

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2024-01-08 · updated 2026-06-17
Weakness: CWE-502

Description

The Slider Revolution WordPress plugin before 6.6.19 does not prevent users with at least the Author role from unserializing arbitrary content when importing sliders, potentially leading to Remote Code Execution.

Affected products

Revolution Slider Slider Revolution: before 6.6.19 — fixed in 6.6.19

How to fix

Upgrade to a fixed version: Revolution Slider Slider Revolution 6.6.19. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/36ced447-84ea-4162-80d2-6df226cb53cb
https://wpscan.com/vulnerability/36ced447-84ea-4162-80d2-6df226cb53cb

Get alerted when CVE-2023-6528 or the next vulnerability affects your stack