Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2024-7150: The Slider by 10Web WordPress plugin can reveal sensitive data

CVE-2024-7150 · published 2 years ago

Summary

The Slider by 10Web WordPress plugin has a security flaw that allows attackers with contributor-level access to potentially extract sensitive information from the database. This is a concern for WordPress sites using the plugin. To protect your site, update to a fixed version of the plugin as soon as possible.

What to do

Update 10web slider to version 1.2.58 or later.

Affected software

Vendor	Product	Affected versions
10web	slider	< 1.2.58 `cpe:2.3:a:10web:slider::::::wordpress::*`

Original advisory text

The Slider by 10Web – Responsive Image Slider plugin for WordPress is vulnerable to time-based SQL Injection via the 'id' parameter in all versions up to, and including, 1.2.57 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

References

https://plugins.trac.wordpress.org/browser/slider-wd/tags/1.2.57/frontend/models... Product
https://plugins.trac.wordpress.org/changeset/3131688/ Patch
https://wordpress.org/plugins/slider-wd/#developers Product
https://www.wordfence.com/threat-intel/vulnerabilities/id/74d635b6-2b4a-49af-af5... Third Party Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

8.8 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-89SQL Injection

Timeline

Published8 Aug 2024

Updated4 Nov 2026

First seen7 Mar 2026

Sources

CVE-2024-7150 · NVD

Track software like this

Free during beta