The vulnerability enables an authenticated user with Contributor or higher privileges to deactivate any active plugin on the site. This is a CWE-862 (Missing Authorization) weakness. Because the Slider Revolution plugin fails to verify user authorization, a normal contributor can perform the deactivation action without permission. This can disrupt site functionality, remove security or backup plugins, and potentially facilitate further exploitation if the attacker can replace or disable protective components.

All installations of the Slider Revolution plugin for WordPress from versions 6.0.0 through 6.7.55 and from 7.0.0 through 7.0.14 are affected. The plugin is distributed by Revolution Slider and integrated into WordPress sites.

With a CVSS score of 4.3 the issue is considered moderate. Exploitation requires only authenticated access with Contributor level or higher, a role commonly available on many WordPress sites. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, indicating no known widespread exploitation yet. Attackers could use the deactivation capability to disable critical plugins or create a denial‑of‑service scenario.