Description

Unauthenticated Cross Site Request Forgery (CSRF) in Slider by 10Web <= 1.2.62 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.4",
  "pubDate": "2026-08-18T15:16:58.087Z",
  "pubdate": "2026-08-18T15:16:58.087Z",
  "executiveSummary": "An unauthenticated Cross-Site Request Forgery (CSRF) vulnerability has been identified in the Slider by 10Web plugin, affecting versions 1.2.62 and prior. This security flaw allows malicious actors to trick authenticated administrators or privileged users into executing unintended actions on the affected WordPress site without their consent.\nThe primary impact of this vulnerability involves unauthorized state-changing operations performed within the administrative context of the vulnerable web application. Depending on the specific functionality targeted by the forged requests, attackers could potentially manipulate plugin settings, inject malicious configurations, or perform other administrative tasks.\nThe affected system is the Slider by 10Web plugin running on WordPress installations. The risk implications are moderate to high, as successful exploitation relies on social engineering—specifically, inducing a victim with administrative privileges to visit a malicious website or click a crafted link while authenticated to the target application.\nThe attack capability is unauthenticated in terms of the initial request origin, but it requires the target user to possess active administrative privileges and an active session. No specific exploitation requirements are needed beyond standard web browser interaction by the targeted victim.",
  "technicalDetails": "The root cause of this vulnerability stems from the absence or improper implementation of anti-CSRF tokens (such as nonces) within the request handling mechanisms of the Slider by 10Web plugin. Without cryptographic validation tokens to verify the intentionality of incoming requests, the application blindly processes state-changing operations initiated by external domains.\nThe vulnerable component resides within the administrative action handlers of the Slider by 10Web plugin, specifically affecting versions 1.2.62 and below. Network exposure is broad, as the application accepts Hypertext Transfer Protocol (HTTP) requests originating from web browsers interacting with the WordPress installation.\nThe exploitation method relies on embedding malicious requests—such as HTML forms, hidden image tags, or JavaScript fetch operations—within an external third-party domain controlled by the attacker. When an authenticated administrator visits this malicious page, the browser automatically includes stored session cookies or authentication credentials along with the forged cross-origin request directed at the vulnerable WordPress site.\nThe step-by-step attack flow proceeds as follows: First, the attacker crafts a malicious web page containing an automated script or auto-submitting form targeting a specific administrative endpoint within the Slider by 10Web plugin. Second, the attacker induces an authenticated site administrator to navigate to the malicious URL via phishing or drive-by exposure. Third, the victim's browser dispatches the forged HTTP request, complete with valid session identifiers, to the target application. Fourth, due to the lack of nonce verification, the plugin processes the request and executes the requested state change under the security context of the victim. Finally, the attacker achieves unauthorized modification of the application state, leading to potential post-exploitation manipulation of plugin data."
}