Introduction
On sites running the B Slider Gutenberg Slider Block for WP plugin, an attacker with the lowest level of WordPress access can escalate privileges and install arbitrary plugins. That turns a plain subscriber account into a starting point for full site compromise and remote code execution.
B Slider is available from the official WordPress repository and adds slider functionality to Gutenberg-based sites. It is popular with site owners who want an easy way to improve how they present content. The WordPress plugin ecosystem is large and varied, and security maturity differs widely from one plugin developer to the next. That variation shapes the risk of running third-party plugins like B Slider.
Technical information
CVE-2025-8418 comes from missing capability checks in the activated_plugin function of the B Slider Gutenberg Slider Block for WP plugin. WordPress uses a role-based access control model in which only users with administrator privileges should be able to install or activate plugins. Code usually enforces this by checking a user capability, such as install_plugins or activate_plugins, before it performs a privileged action.
In all versions up to and including 1.1.30, the B Slider plugin does not check user capabilities in the activated_plugin function. Any authenticated user with subscriber-level access or above can therefore call this function and install arbitrary plugins. This directly violates WordPress security best practices and is a classic CWE-862 (Missing Authorization) issue.
A public code reference confirms that the capability checks are missing:
// Reference: https://plugins.trac.wordpress.org/browser/b-slider/tags/1.1.28/adminMenu.php#L124 function activated_plugin() { // ... missing capability check ... // plugin installation logic }
Attackers can exploit this by sending crafted HTTP requests to endpoints that trigger the vulnerable function. Once they can install arbitrary plugins, they can upload and activate a malicious one, which leads to privilege escalation, data theft, or remote code execution.
Affected systems and versions
- Product: B Slider Gutenberg Slider Block for WP plugin for WordPress
- Affected versions: All versions up to and including 1.1.30
- Any WordPress installation with this plugin at or below version 1.1.30 is vulnerable
- Any authenticated user with subscriber-level access or higher can exploit the vulnerability
Vendor security history
B Slider has no public record of previous major vulnerabilities. Similar missing authorization and privilege escalation issues have been documented in many other WordPress plugins. The plugin is maintained on the official WordPress repository, but the vendor's security maturity and patch response time are not well established.
