CVE-2023-6077 json
Slider - Ultimate Responsive Image Slider < 3.5.12 - Subscriber+ Arbitrary Post Access
published 2023-12-18 2 y ago modified 2026-06-17 4 mo ago also EUVD-2023-58333
- cvss
- 6.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.7%
- EPSS 0.7% chance of exploitation in 30 days, percentile 52%
- public exploits
- 0
- none known
Summary
The Slider WordPress plugin before 3.5.12 does not ensure that posts to be accessed via an AJAX action are slides and can be viewed by the user making the request, allowing any authenticated users, such as subscriber to access the content arbitrary post such as private, draft and password protected
Patch / fix
- Unknown Slider 3.5.12
Exploit prediction
0.66% chance of exploitation in the next 30 days, higher than 52% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- wpscan.com https://wpscan.com/vulnerability/1afc0e4a-f712-47d4-bf29-7719ccbbbb1b referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
Affected products
- Unknown Slider
Classification
- Technology feeds
References
-
wpscan.com
/vulnerability/1afc0e4a-f712-47d4-bf29-7719ccbbbb1b
exploit, vdb-entry, technical-description, third-party-advisory
Sources
- CVE List CVE-2023-6077
- NVD CVE-2023-6077
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.