CVE-2026-39465: WordPress Responsive Slider by MetaSlider plugin <= 3.106.0 - Remote Code Execution (RCE) vulnerability

Synopsis

A remote code execution vulnerability exists in the Responsive Slider by MetaSlider WordPress plugin at versions 3.106.0 and below. The flaw is reachable over the network and requires a high-privilege account, such as an administrator, but once authenticated an attacker can execute arbitrary code on the server. Successful exploitation gives the attacker full control over confidentiality, integrity, and availability of the affected host, including any data it processes. No fix version has been published; HarborGuard tracks this advisory and will make a patched-image rebuild available as soon as upstream ships a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable plugin endpoint is exposed over the network, meaning an attacker must be able to reach the WordPress installation via HTTP or HTTPS.

• AuthenticationRequired

  An admin or similarly high-privileged WordPress account is needed to trigger the vulnerable code path.

• Victim interactionNot required

  No action from another user or victim is needed; the attacker drives the exploit entirely without social engineering.

• Attack complexityDetail

  Exploit conditions are reliable and require no special timing, race conditions, or environmental setup beyond holding the required credentials.

Blast Radius

• Attacker executes arbitrary operating system commands on the web server hosting the WordPress installation.
• All data stored in the WordPress database, including user credentials, session tokens, and site content, becomes readable.
• Attacker can write, modify, or delete files on the server, including WordPress core files, plugin code, and uploaded media.
• The underlying service can be crashed or rendered unavailable, taking down all sites hosted on the same server instance.