The WordPress plugin Image Slider by Ays is vulnerable to a cross‑site request forgery attack that permits an unauthenticated attacker to delete sliders. The flaw arises from missing or incorrect nonce validation on the bulk delete functionality, allowing an attacker to trick an authenticated site administrator into executing a forged delete request. The effect is loss of slider content, potential disruption of the site’s appearance, and loss of administrative control over media items.

All WordPress installations running the Image Slider by Ays‑Responsive Slider and Carousel plugin version 2.7.0 or earlier are affected. The vulnerability exists for the plugin as a whole, regardless of specific slider content, and therefore any site that has not upgraded past version 2.7.0 is at risk. There is no indication that other plugins or core WordPress would be impacted.

The CVSS score of 4.3 classifies the weakness as moderate severity, and the EPSS score of less than 1% indicates a very low likelihood of exploitation in the wild. Because the vulnerability requires the victim to be an authenticated site administrator who can be lured into clicking a crafted link, the attack vector is inferred to be CSRF via a user action. The vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been widely exploited or recognized as a known exploit.