CVE-2025-48334

WordPress Woo Slider Pro <= 1.12 - Arbitrary Content Deletion Vulnerability

View on CVE.org
Published May 30, 2025 CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Description
Missing Authorization vulnerability in BinaryCarpenter Woo Slider Pro woo-slider-pro-drag-drop-slider-builder-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Woo Slider Pro: from n/a through <= 1.12.

Analysis

AI-generated

Technical impact

The vulnerability is a missing authorization flaw that allows an attacker to delete arbitrary content from a WordPress site. Exploitation requires only the ability to access the Woo Slider Pro plugin’s interface, potentially without privileged credentials. The flaw could result in loss of posts, pages, or media items, compromising data integrity for the site owner.

Affected Systems

All installations of BinaryCarpenter Woo Slider Pro up to and including version 1.12 are affected. The plugin is distributed via WordPress and runs on any WordPress site hosting the Woo Slider Pro drag‑drop slider.

Risk and Exploitability

The CVSS score of 6.5 denotes moderate severity. The EPSS score is below 1 %, indicating that the likelihood of exploitation is low at present. It is not listed in CISA’s KEV catalog. The attack vector is inferred to be remote, web‑based, and does not require legitimate authentication if the plugin’s access controls are misconfigured.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Woo Slider Pro to the latest version (≥1.13) or remove the plugin if it is not required.
  • Confirm that only users with appropriate roles have delete permissions in the plugin settings and enforce role‑based access controls.
  • Perform a site‑wide review of file permissions and hard‑coded references to the vulnerable plugin to prevent reuse.
  • Conduct periodic vulnerability scanning and monitor for unauthorized content deletions.

Generated by OpenCVE AI on April 30, 2026 at 18:45 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2025-16468 Missing Authorization vulnerability in BinaryCarpenter Woo Slider Pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Woo Slider Pro: from n/a through 1.12. Affected action "woo_slide_pro_delete_slider".
History
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'}

 cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}
Type Values Removed Values Added
Description Missing Authorization vulnerability in BinaryCarpenter Woo Slider Pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Woo Slider Pro: from n/a through 1.12. Affected action "woo_slide_pro_delete_slider". Missing Authorization vulnerability in BinaryCarpenter Woo Slider Pro woo-slider-pro-drag-drop-slider-builder-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Woo Slider Pro: from n/a through <= 1.12.
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

 cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'}
Type Values Removed Values Added
First Time appeared Binarycarpenter
Binarycarpenter woo Slider Pro
CPEs cpe:2.3:a:binarycarpenter:woo_slider_pro:*:*:*:*:*:wordpress:*:*
Vendors & Products Binarycarpenter
Binarycarpenter woo Slider Pro
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description Missing Authorization vulnerability in BinaryCarpenter Woo Slider Pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Woo Slider Pro: from n/a through 1.12. Affected action "woo_slide_pro_delete_slider".
Title WordPress Woo Slider Pro <= 1.12 - Arbitrary Content Deletion Vulnerability
Weaknesses CWE-862
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}
Weaknesses

Sources

Status
PUBLISHED
Assigner
Patchstack
Published
Updated
Apr 28, 2026, 4:12 PM
Reserved
May 19, 2025, 2:14 PM

View source JSON

Updated
May 30, 2025, 12:52 PM

JSON

Status
Modified
Published
May 30, 2025, 9:15 AM
Modified
Jun 17, 2026, 9:29 AM

View source JSON

No data.

Updated
Apr 30, 2026, 7:00 PM

JSON