Loading vulnerability…
CVE-2026-1405 is an unauthenticated arbitrary file upload vulnerability in the Slider Future WordPress plugin by franchidesign, affecting all versions up to and including 1.0.5. According to the provided content, the issue is caused by missing file type validation in the plugin function 'slider_future_handle_image_upload'. The vulnerable functionality is exposed through the WordPress REST API endpoint '/wp-json/slider-future/v1/upload-image/', which accepts a POST request with an 'image_url' parameter and processes it without authentication. The supplied material indicates the endpoint will fetch attacker-controlled remote content and store it under the WordPress uploads directory, exposing both a public uploads URL and a filesystem path in the JSON response. Because file type validation is absent, an attacker may be able to cause arbitrary files to be uploaded to the server, which can lead to code execution if executable content is accepted and reachable.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
Repository contains a single Python3 exploit tool (`CVE-2026-1405.py`) plus README, LICENSE, and `requirements.txt` (requests, rich). The script is a mass exploitation utility for CVE-2026-1405 affecting the WordPress Slider Future plugin (<= 1.0.5), leveraging an unauthenticated arbitrary file upload via the REST endpoint `/wp-json/slider-future/v1/upload-image/`. Core behavior: - Reads a list of target base URLs from a user-supplied file (default `list.txt`) and normalizes them (adds http:// if missing). - For each target, sends a POST request to `TARGET + /wp-json/slider-future/v1/upload-image/` with form data `image_url=<attacker_shell_url>`. - Parses the response (JSON or regex) to extract a returned `url` field that should point to the uploaded file on the victim. - Verifies exploitation by issuing a GET request to the extracted URL and checking for HTTP 200 and an operator-provided signature string in the response body. - Runs concurrently using `ThreadPoolExecutor` (default 10 threads) and writes verified successes to `success_results.txt`. Notable implementation details: - Disables TLS verification (`verify=False`) and suppresses urllib3 warnings. - Sets `NO_PROXY='*'` to avoid proxy use. - Uses a distinctive User-Agent string: `NxploitedScanner/1.1 (+https://github.com/Nxploited)`. Overall purpose: operational mass uploader/validator intended to plant a PHP webshell (hosted externally by the operator) onto vulnerable WordPress sites, enabling follow-on remote code execution via the uploaded shell.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A critical vulnerability in a WordPress endpoint (/wp-json/slider-future/v1/upload-image/) that appears to allow server-side request forgery (SSRF), as demonstrated by an outbound DNS interaction to an OAST domain.
An unauthenticated arbitrary file upload / server-side remote file fetch issue in the WordPress Slider Future plugin (<= 1.0.5) via a REST API endpoint that accepts an attacker-controlled image_url without authentication or validation, enabling server-side fetching and potentially leading to malicious file upload/placement depending on implementation.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.