The B Slider- Gutenberg Slider Block for WP plugin suffers from a missing capability check in the activated_plugin function, allowing authenticated users with Subscriber role or higher to install arbitrary plugins. This flaw can be leveraged to execute remote code on the WordPress site, representing a serious confidentiality, integrity, and availability threat. The weakness is classified as CWE-862, reflecting an authorization failure.

The vulnerability affects the bSlider – Create Responsive Image, Post, Product, and Video Sliders plugin supplied by bplugins. All versions up to and including 1.1.30 are impacted; newer releases beyond 1.1.30 contain the fix.

With a high CVSS score of 8.8, the exploit would require the attacker to be authenticated within the WordPress installation, which is a relatively low effort barrier for local or compromised accounts. The EPSS score is below 1%, indicating low current exploitation activity, and the issue is not yet listed in the CISA KEV catalog. Nevertheless, any subscriber or higher role user could install malicious plugins that may lead to remote code execution.