CVE-2023-2359: Revolution Slider <= 6.6.12 - Author+ Remote Code Execution
Vulnerability summary
CVE-2023-2359 is a high (CVSS 8.8) Improper Control of Generation of Code vulnerability in themepunch slider_revolution. EPSS estimates a 2.54% chance of exploitation in the next 30 days, higher than 85.1% of scored vulnerabilities. 2 public exploits are recorded.
Public exploit (reference, Date unknown)
Source freshness unavailable
How is this decided?Timeline
- 19-06-2023PublishedVulnerability first disclosed.
- 12-12-2024Last modifiedVulnerability information updated.
Description
The Slider Revolution WordPress plugin through 6.6.12 does not check for valid image files upon import, leading to an arbitrary file upload which may be escalated to Remote Code Execution in some server configurations.
CVSS metrics
2 scores · 2 sources · 1 version- wordfenceSource7.2HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HDiffers
EPSS trend
Probability
2.54%
Chance of exploitation in the next 30 days
Percentile
85%
Versus all other CVEs
30-day change
No change 0.00 pp
From 2.54% on 11-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
2 foundExploit Reference (wpscan.com)
Maturity: unknown
Exploit Reference (wpscan.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-94Improper Control of Generation of CodeThe product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
- CWE-434Unrestricted Upload of File with Dangerous TypeThe product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Affected systems
Known conditions: network-reachable, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Themepunch1 product
- slider_revolution≤ 6.6.12
Unknown1 product
- slider revolution≤ 6.6.12
Wordpress1 product
- revslider≤ 6.6.12 (fixed in 6.6.13)
3 vendors · 3 products
References
3 links- wpscan.com/vulnerability/a8350890-e6d4-4b04-a158-2b0ee3748e65ExploitVDB EntryTechnical DescriptionThird Party Advisory