Unauthenticated Arbitrary File Upload in WordPress Slider Future Plugin
CVE-2026-1405 is an unauthenticated arbitrary file upload vulnerability in the Slider Future WordPress plugin by franchidesign, affecting all versions up to and including 1.0.5. According to the provided content, the issue is caused by missing file type validation in the plugin function 'slider_future_handle_image_upload'. The vulnerable functionality is exposed through the WordPress REST API endpoint '/wp-json/slider-future/v1/upload-image/', which accepts a POST request with an 'image_url' parameter and processes it without authentication. The supplied material indicates the endpoint will fetch attacker-controlled remote content and store it under the WordPress uploads directory, exposing both a public uploads URL and a filesystem path in the JSON response. Because file type validation is absent, an attacker may be able to cause arbitrary files to be uploaded to the server, which can lead to code execution if executable content is accepted and reachable.
Are you exposed to this one?
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
Impact, mitigation & remediation
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
Impact
What an attacker gets, and what they’ve been doing with it.
Mitigation
If you can’t patch tonight, do this now.
Remediation
Patch, then assume compromise.
Exploits
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
Repository contains a single Python3 exploit tool (`CVE-2026-1405.py`) plus README, LICENSE, and `requirements.txt` (requests, rich). The script is a mass exploitation utility for CVE-2026-1405 affecting the WordPress Slider Future plugin (<= 1.0.5), leveraging an unauthenticated arbitrary file upload via the REST endpoint `/wp-json/slider-future/v1/upload-image/`. Core behavior: - Reads a list of target base URLs from a user-supplied file (default `list.txt`) and normalizes them (adds http:// if missing). - For each target, sends a POST request to `TARGET + /wp-json/slider-future/v1/upload-image/` with form data `image_url=<attacker_shell_url>`. - Parses the response (JSON or regex) to extract a returned `url` field that should point to the uploaded file on the victim. - Verifies exploitation by issuing a GET request to the extracted URL and checking for HTTP 200 and an operator-provided signature string in the response body. - Runs concurrently using `ThreadPoolExecutor` (default 10 threads) and writes verified successes to `success_results.txt`. Notable implementation details: - Disables TLS verification (`verify=False`) and suppresses urllib3 warnings. - Sets `NO_PROXY='*'` to avoid proxy use. - Uses a distinctive User-Agent string: `NxploitedScanner/1.1 (+https://github.com/Nxploited)`. Overall purpose: operational mass uploader/validator intended to plant a PHP webshell (hosted externally by the operator) onto vulnerable WordPress sites, enabling follow-on remote code execution via the uploaded shell.
Recent activity
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A critical vulnerability in a WordPress endpoint (/wp-json/slider-future/v1/upload-image/) that appears to allow server-side request forgery (SSRF), as demonstrated by an outbound DNS interaction to an OAST domain.
An unauthenticated arbitrary file upload / server-side remote file fetch issue in the WordPress Slider Future plugin (<= 1.0.5) via a REST API endpoint that accepts an attacker-controlled image_url without authentication or validation, enabling server-side fetching and potentially leading to malicious file upload/placement depending on implementation.
The version that knows your environment.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.