CVE-2026-66635: WordPress Slider by 10Web plugin <= 1.2.63 - Cross Site Request Forgery (CSRF) vulnerability

Q: What does an attacker need to exploit this issue?

An attacker does not need an account, but exploitation requires a victim to interact with a malicious request while authenticated to a vulnerable WordPress site. The attack is network-reachable and has low complexity.

Q: Which installations are affected?

Slider by 10Web versions 1.2.62 and earlier are identified as affected. The available data does not state whether any particular plugin or WordPress configuration changes exposure.

Q: What is the likely impact if exploitation succeeds?

Successful exploitation can result in arbitrary file deletion, causing a high availability impact. The provided data does not identify confidentiality or integrity impact.

Published Aug 18, 2026

Updated

Cross-Site Request Forgery (CSRF) vulnerability in 10Web Slider by 10Web slider-wd allows Cross Site Request Forgery.This issue affects Slider by 10Web: from n/a through 1.2.63.

Affected Software

1 affected component

10web Slider by 10Web<=1.2.63

Event History

Aug 18, 2026

CVE Published

via MITRE·01:59 PM

Data Sourced

via MITRE·01:59 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What does an attacker need to exploit this issue?

An attacker does not need an account, but exploitation requires a victim to interact with a malicious request while authenticated to a vulnerable WordPress site. The attack is network-reachable and has low complexity.

Which installations are affected?

Slider by 10Web versions 1.2.62 and earlier are identified as affected. The available data does not state whether any particular plugin or WordPress configuration changes exposure.

What is the likely impact if exploitation succeeds?