CVE-2026-14244: Jssor Slider WordPress Plugin Directory Traversal Vulnerability

Technical summary

CVE-2026-14244 is a path traversal vulnerability (CWE-22) in the Jssor Slider WordPress plugin. The vulnerability exists in the handling of the 'url' parameter, which fails to properly validate or sanitize user input. An attacker can craft requests using directory traversal sequences (such as '../') to escape the intended file directory and access arbitrary files readable by the web server process. The vulnerability requires no authentication and no user interaction, making it trivially exploitable via a simple HTTP request.

Business impact

Exploitation of this vulnerability could expose sensitive organizational data, including WordPress configuration files containing database credentials, authentication keys, and API tokens. Attackers may gain access to customer information, business logic details, or other intellectual property stored in readable files. This can lead to further compromise of the WordPress installation, data breaches, and potential regulatory violations if personal data is exposed.

Affected systems

All installations of the Jssor Slider plugin for WordPress up to and including version 3.1.24 are affected. This includes any website using this popular image slider plugin on the WordPress platform. The vulnerability affects both single-site and multisite WordPress installations where the plugin is active.

Exploitability

This vulnerability is trivial to exploit. No authentication is required, no special conditions need to be met, and exploitation can be automated. An attacker needs only to craft an HTTP request with a manipulated 'url' parameter containing directory traversal sequences. The network-accessible attack vector and low attack complexity mean that opportunistic scanning and exploitation are likely occurring in the wild.

Remediation

Update the Jssor Slider plugin immediately to a patched version released after 3.1.24. Verify the updated version against the official plugin repository or vendor advisory to confirm the vulnerability has been addressed. After patching, verify that the plugin is functioning correctly in your WordPress environment.

Patch guidance

Navigate to your WordPress admin dashboard, go to Plugins > Installed Plugins, locate Jssor Slider, and check for available updates. Click 'Update Now' if an update is available. Alternatively, deactivate and delete the plugin, then reinstall the latest version from the official WordPress plugin repository. After updating, test the slider functionality on your site. If no patch is available from the vendor, consider temporarily disabling the plugin until a fix is released, and evaluate alternative slider plugins that are actively maintained.

Detection guidance

Monitor web server logs for requests containing directory traversal patterns in the 'url' parameter, such as sequences like '../', '..\', or encoded variants (%2e%2e%2f). Look for GET or POST requests to the Jssor Slider plugin files with unusual path parameters. Web Application Firewalls (WAF) should be configured to block directory traversal attempts. If available, enable the plugin's debug logging to capture suspicious parameter usage. Check for unauthorized access to sensitive files like wp-config.php or .env files in server logs.

Why prioritize this

This vulnerability merits immediate remediation despite being unpublished in CISA's KEV catalog. The combination of complete lack of authentication requirements, trivial exploitability, high confidentiality impact, and the popularity of WordPress and slider plugins creates significant risk. Attackers can harvest sensitive data without leaving obvious traces of compromise, making post-breach detection difficult.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects a vulnerability with network attack vector, no authentication required, low attack complexity, and high confidentiality impact. The score does not account for the popularity and widespread deployment of WordPress plugins, which multiplies the practical risk. The lack of integrity and availability impact prevents a critical rating, but confidentiality exposure of configuration and credential data justifies the high severity designation.

Frequently asked questions