CVE-2024-2879 is a Critical severity (CVSS 9.8) SQL injection in the LayerSlider WordPress plugin, in versions 7.9.11 and 7.10.0, through the ls_get_popup_markup action. Unauthenticated attackers can read data from the site database. Update to a release newer than 7.10.0 right away, or deactivate the plugin.
What's affected
- Product: LayerSlider plugin for WordPress (Kreatura).
- Affected: versions 7.9.11 and 7.10.0, per the record.
- Fixed: a release newer than 7.10.0. The LayerSlider release log and Wordfence page did not give us a readable changelog, so confirm the exact version in your dashboard.
- Weakness: CWE-89.
- Access needed: none (CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
How to check if you're exposed
With WP-CLI:
wp plugin list | grep -i layerslider
Or check Plugins in the dashboard. Versions 7.9.11 and 7.10.0 are the ones the record names. Premium plugins sometimes bundled in themes may not show updates, so check theme bundles too.
What to do now
- Find every WordPress site running LayerSlider, including copies bundled with themes.
- Update to the newest release from the vendor.
- If you cannot update at once, deactivate the plugin until you can.
- Review database and web logs for unusual requests to the AJAX endpoint.
- Rotate credentials stored in the database if you see signs of probing.
Why it matters
SQL injection happens when user input is concatenated into a database query instead of being passed as a bound parameter. The input can then change the meaning of the query and read data the user should not see.
The reliable fix is prepared statements. In WordPress code that means calling the database object's prepare method for every query that includes user supplied values.
Because the vector needs no login, any exposed site running the two named versions is within reach. The affected window is narrow, only two releases, which is why checking the exact installed version matters. Bundled plugins are the usual blind spot.
KEV status: the record has the CISA Known Exploited Vulnerabilities flag set to false, and none of the sources we could read says this is exploited in the wild. That can change, so watch for updates.
Try it yourself
Fast moving plugin flaws are why watch lists exist. The zero day watch demo shows how a new CVE reaches you.
Click through it at your own pace, or open it full screen.
Quick check
Do attackers need an account?
No. The record says unauthenticated attackers.
Which versions are affected?
7.9.11 and 7.10.0, according to the record.
Sources
Record references (neither gave readable detail when we fetched them):
- https://layerslider.com/release-log/
- https://www.wordfence.com/threat-intel/vulnerabilities/id/3fddf96e-029c-4753-ba82-043ca64b78d3?source=cve
Last reviewed: 19 October 2026.
