WordPress Slider Future <= 1.0.5 - Unauthenticated Arbitrary File Upload
CVE-2026-1405
Verified
Description
Slider Future WordPress plugin <= 1.0.5 contains an unrestricted file upload vulnerability caused by missing file type validation in 'slider_future_handle_image_upload', letting unauthenticated attackers upload arbitrary files, exploit requires no authentication.
Severity
Critical
CVSS Score
9.8
Exploit Probability
3%
Published Date
March 23, 2026
Template Author
pussycat0x
CVE-2026-1405.yaml
9.8Score
CVSS Metrics
CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE ID:
cve-2026-1405
CWE ID:
cwe-434
References
Remediation Steps
Update to a version later than 1.0.5 or the latest available version.