The bSlider WordPress plugin suffers from a missing authorization vulnerability (CWE-862) in its activated_plugin function. This flaw permits authenticated users with low privileges (subscriber-level and above) to install arbitrary plugins on the WordPress server. Such unauthorized plugin installation can enable remote code execution, compromising the server's confidentiality, integrity, and availability. The vulnerability affects all versions up to 1.1.30. There is no vendor-provided patch or advisory available at this time. The CVSS v3.1 base score is 8.8, reflecting network attack vector, low attack complexity, privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an authenticated user with subscriber-level privileges or higher to install arbitrary plugins on the WordPress server. This can lead to remote code execution, resulting in full compromise of the server, including data theft, modification, or service disruption. The vulnerability impacts all versions of the bSlider plugin up to 1.1.30. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber-level user accounts from untrusted users and monitor for suspicious plugin installations. Consider disabling or removing the bSlider plugin if it is not essential. Avoid granting unnecessary privileges to low-level users to reduce risk.