CVE-2023-6528 is a high severity flaw in the Slider Revolution plugin for WordPress. Before version 6.6.19, users with the Author role can cause arbitrary content to be unserialized during slider import, potentially leading to remote code execution. Update to 6.6.19 or later.
What's affected
- Product: Slider Revolution from ThemePunch, a WordPress plugin.
- Affected: versions before 6.6.19, per the record.
- Fixed: 6.6.19.
- Role needed: Author or above.
The record gives a CVSS 3.1 base score of 8.8 (high) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The CISA Known Exploited Vulnerabilities flag in the record is false. This post does not claim exploitation in the wild.
How to check if you're exposed
wp plugin list --fields=name,status,version
Find the plugin in the output and compare its version with the affected range above. If you do not use wp-cli, open the Plugins screen in the WordPress admin and read the version shown under the plugin name.
Slider Revolution is often bundled inside a theme and updated through the theme. Check the theme documentation too, since the plugin version inside a bundle can lag behind.
What to do now
- Find every site with Slider Revolution, including copies bundled in themes.
- Update to 6.6.19 or later through the vendor channel.
- Audit accounts with the Author role or higher and remove those not needed.
- Review recent slider imports in the admin and the uploads folder for unexpected content.
- Run the free in-browser dependency scan at gold.safeguard.sh/scan on any project you build that bundles this component, and keep the result next to your inventory.
Why it matters
The record maps this issue to CWE-502 (Deserialization of Untrusted Data): Data supplied from outside is turned back into live objects without checks, which can trigger unintended code paths.
Deserialization turns stored data back into objects. When the data comes from a user and the class list is wide, the objects can trigger code paths the developer never meant to expose, which is how a data import becomes a code execution risk.
Author accounts are common on multi-author sites, and they are not usually treated as sensitive. This flaw lowers the bar from administrator to author for a risky action. Bundled plugins add a second problem, since the site owner may not know the plugin is there.
Quick check
Do I need to be an admin to exploit this?
No. The record says users with at least the Author role are able to trigger it.
My theme bundles the plugin. What do I do?
Check the theme vendor for an update that includes 6.6.19 or later.
Sources
These are the references listed in the NVD record for this CVE. They were not fetched when this post was written, so confirm fixed versions in the advisory before acting.
Last reviewed: 19 October 2026.
