The Slider Revolution plugin for WordPress suffers from a relative path traversal vulnerability due to missing capability checks on multiple functions. This flaw permits authenticated attackers with Contributor-level privileges or above to bypass intended access controls, enabling them to install and activate plugin add-ons, create sliders, and download arbitrary files from the server. The vulnerability affects all versions up to and including 6.7.37. The CVSS 3.1 base score is 6.5, reflecting a network attack vector with low complexity, requiring privileges but no user interaction, and resulting in high confidentiality impact without affecting integrity or availability.

An attacker with Contributor-level access or higher can exploit this vulnerability to gain unauthorized capabilities within the WordPress environment, including installing and activating additional plugin add-ons and downloading arbitrary files. This could lead to unauthorized data disclosure. There is no indication of integrity or availability impact. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access to trusted users only and monitor for suspicious activity related to plugin add-ons and file downloads. Do not grant Contributor or higher privileges to untrusted users.