CVE-2026-1405 PoC — WordPress plugin Slider Future 代码问题漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-1405.yaml

Associated Vulnerability

Title:WordPress plugin Slider Future 代码问题漏洞 (CVE-2026-1405)
Description:WordPress和WordPress plugin都是WordPress基金会的产品。WordPress是一套使用PHP语言开发的博客平台。该平台具有在基于PHP和MySQL的服务器上架设个人博客网站的功能。WordPress plugin是一个应用插件。 WordPress plugin Slider Future 1.0.5及之前版本存在代码问题漏洞，该漏洞源于函数slider_future_handle_image_upload缺少文件类型验证，可能导致未经验证的攻击者上传任意文件。

Description

Slider Future WordPress plugin <= 1.0.5 contains an unrestricted file upload vulnerability caused by missing file type validation in 'slider_future_handle_image_upload', letting unauthenticated attackers upload arbitrary files, exploit requires no authentication.

File Snapshot


 id: CVE-2026-1405

info:
  name: WordPress Slider Future <= 1.0.5 - Unauthenticated Arbitrary File U

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!