The Slider Future WordPress plugin allows an unauthenticated attacker to upload files without validating the file type, a weakness classified as CWE-434. The vulnerable function processes uploads in all releases up to version 1.0.5, permitting any file—including executable scripts—to be stored on the web server. The CVE description states that uploading such scripts may lead to remote code execution, as it specifically says a remote code execution may be possible.

WordPress sites that have the Slider Future plugin installed with a version of 1.0.5 or earlier. The affected product is franchidesign:Slider Future, which is widely available through the WordPress plugin repository.

The vulnerability scores a CVSS of 9.8, indicating a critical risk level. An EPSS of 16% implies a moderate likelihood that exploit code has already appeared in the wild. Because the upload endpoint can be accessed by any user via a public URL and requires no authentication, the potential impact is global to the host. The vulnerability is not currently listed in the CISA KEV catalog, but the combination of high severity and an accessible upload endpoint makes it a prime target.