The Slider Revolution plugin for WordPress contains a missing capability check in multiple functions through version 6.7.37. This flaw allows authenticated users with Contributor-level access or higher to install and activate add‑ons, create new sliders, and download arbitrary files that the site hosts. This is a CWE‑23 vulnerability because the lack of proper path validation permits directory traversal. An attacker can therefore elevate their functional access to the site, potentially exfiltrate sensitive files or deploy malicious add‑ons that could compromise the entire WordPress installation.

Revolution Slider (Slider Revolution) for WordPress is affected in all releases up to and including 6.7.37. Users running these versions should review their installation and upgrade to the latest release.

The vulnerability carries a CVSS score of 6.5 and an EPSS score below 1 percent, indicating a moderate severity but a relatively low likelihood of exploitation. It is not listed in the CISA KEV catalog. Attackers only need authenticated Contributor or higher privileges; no external access is required. Once the capability check is bypassed, the attacker can read or download files and install add‑ons, enabling further compromise.