Remote Code Execution in MetaSlider Theme Loading

MetaSlider up to 3.106.0 builds a PHP include path from the theme folder and version stored in a slideshow’s settings without sanitizing them, and checks imported theme images only by MIME type. A user with Editor access can plant a payload file and point a slideshow’s theme at it through path traversal, leading to remote code execution.

This vulnerability affects the following application versions:

• Slider, Gallery, and Carousel by MetaSlider 3.17.0
• Slider, Gallery, and Carousel by MetaSlider 3.17.1
• Slider, Gallery, and Carousel by MetaSlider 3.17.2
• Slider, Gallery, and Carousel by MetaSlider 3.17.3
• Slider, Gallery, and Carousel by MetaSlider 3.17.4
• Slider, Gallery, and Carousel by MetaSlider 3.17.5
• Slider, Gallery, and Carousel by MetaSlider 3.17.6
• Slider, Gallery, and Carousel by MetaSlider 3.18.0
• Slider, Gallery, and Carousel by MetaSlider 3.18.1
• Slider, Gallery, and Carousel by MetaSlider 3.18.2
• Slider, Gallery, and Carousel by MetaSlider 3.18.3
• Slider, Gallery, and Carousel by MetaSlider 3.18.4
• Slider, Gallery, and Carousel by MetaSlider 3.18.5
• Slider, Gallery, and Carousel by MetaSlider 3.18.6
• Slider, Gallery, and Carousel by MetaSlider 3.18.7
• Slider, Gallery, and Carousel by MetaSlider 3.18.8
• Slider, Gallery, and Carousel by MetaSlider 3.18.9
• Slider, Gallery, and Carousel by MetaSlider 3.19.0
• Slider, Gallery, and Carousel by MetaSlider 3.19.1
• Slider, Gallery, and Carousel by MetaSlider 3.20.0
• Slider, Gallery, and Carousel by MetaSlider 3.20.1
• Slider, Gallery, and Carousel by MetaSlider 3.20.2
• Slider, Gallery, and Carousel by MetaSlider 3.20.3
• Slider, Gallery, and Carousel by MetaSlider 3.21.0
• Slider, Gallery, and Carousel by MetaSlider 3.22.0
• Slider, Gallery, and Carousel by MetaSlider 3.22.1
• Slider, Gallery, and Carousel by MetaSlider 3.23.0
• Slider, Gallery, and Carousel by MetaSlider 3.23.1
• Slider, Gallery, and Carousel by MetaSlider 3.23.2
• Slider, Gallery, and Carousel by MetaSlider 3.23.3
• Slider, Gallery, and Carousel by MetaSlider 3.23.4
• Slider, Gallery, and Carousel by MetaSlider 3.23.5
• Slider, Gallery, and Carousel by MetaSlider 3.24.0
• Slider, Gallery, and Carousel by MetaSlider 3.25.0
• Slider, Gallery, and Carousel by MetaSlider 3.25.1
• Slider, Gallery, and Carousel by MetaSlider 3.25.2
• Slider, Gallery, and Carousel by MetaSlider 3.26.0
• Slider, Gallery, and Carousel by MetaSlider 3.27.0
• Slider, Gallery, and Carousel by MetaSlider 3.27.1
• Slider, Gallery, and Carousel by MetaSlider 3.27.2
• Slider, Gallery, and Carousel by MetaSlider 3.27.3
• Slider, Gallery, and Carousel by MetaSlider 3.27.4
• Slider, Gallery, and Carousel by MetaSlider 3.27.5
• Slider, Gallery, and Carousel by MetaSlider 3.27.6
• Slider, Gallery, and Carousel by MetaSlider 3.27.7
• Slider, Gallery, and Carousel by MetaSlider 3.27.8
• Slider, Gallery, and Carousel by MetaSlider 3.27.9
• Slider, Gallery, and Carousel by MetaSlider 3.27.9-beta.2
• Slider, Gallery, and Carousel by MetaSlider 3.27.9-beta.3
• Slider, Gallery, and Carousel by MetaSlider 3.27.10
• Slider, Gallery, and Carousel by MetaSlider 3.27.11
• Slider, Gallery, and Carousel by MetaSlider 3.27.12
• Slider, Gallery, and Carousel by MetaSlider 3.27.13
• Slider, Gallery, and Carousel by MetaSlider 3.27.14
• Slider, Gallery, and Carousel by MetaSlider 3.28.0
• Slider, Gallery, and Carousel by MetaSlider 3.28.1
• Slider, Gallery, and Carousel by MetaSlider 3.28.2
• Slider, Gallery, and Carousel by MetaSlider 3.28.3
• Slider, Gallery, and Carousel by MetaSlider 3.29.0
• Slider, Gallery, and Carousel by MetaSlider 3.29.1
• Slider, Gallery, and Carousel by MetaSlider 3.30.0
• Slider, Gallery, and Carousel by MetaSlider 3.30.1
• Slider, Gallery, and Carousel by MetaSlider 3.31.0
• Slider, Gallery, and Carousel by MetaSlider 3.32.0
• Slider, Gallery, and Carousel by MetaSlider 3.33.0
• Slider, Gallery, and Carousel by MetaSlider 3.34.0
• Slider, Gallery, and Carousel by MetaSlider 3.35.0
• Slider, Gallery, and Carousel by MetaSlider 3.36.0
• Slider, Gallery, and Carousel by MetaSlider 3.37.0
• Slider, Gallery, and Carousel by MetaSlider 3.40.0
• Slider, Gallery, and Carousel by MetaSlider 3.50.0
• Slider, Gallery, and Carousel by MetaSlider 3.60.0
• Slider, Gallery, and Carousel by MetaSlider 3.60.1
• Slider, Gallery, and Carousel by MetaSlider 3.61.0
• Slider, Gallery, and Carousel by MetaSlider 3.62.0
• Slider, Gallery, and Carousel by MetaSlider 3.70.0
• Slider, Gallery, and Carousel by MetaSlider 3.70.1
• Slider, Gallery, and Carousel by MetaSlider 3.70.2
• Slider, Gallery, and Carousel by MetaSlider 3.80.0
• Slider, Gallery, and Carousel by MetaSlider 3.90.0
• Slider, Gallery, and Carousel by MetaSlider 3.90.1
• Slider, Gallery, and Carousel by MetaSlider 3.91.0
• Slider, Gallery, and Carousel by MetaSlider 3.92.0
• Slider, Gallery, and Carousel by MetaSlider 3.92.1
• Slider, Gallery, and Carousel by MetaSlider 3.93.0
• Slider, Gallery, and Carousel by MetaSlider 3.94.0
• Slider, Gallery, and Carousel by MetaSlider 3.95.0
• Slider, Gallery, and Carousel by MetaSlider 3.96.0
• Slider, Gallery, and Carousel by MetaSlider 3.97.0
• Slider, Gallery, and Carousel by MetaSlider 3.98.0
• Slider, Gallery, and Carousel by MetaSlider 3.99.0
• Slider, Gallery, and Carousel by MetaSlider 3.100.0
• Slider, Gallery, and Carousel by MetaSlider 3.100.1
• Slider, Gallery, and Carousel by MetaSlider 3.101.0
• Slider, Gallery, and Carousel by MetaSlider 3.102.0
• Slider, Gallery, and Carousel by MetaSlider 3.103.0
• Slider, Gallery, and Carousel by MetaSlider 3.104.0
• Slider, Gallery, and Carousel by MetaSlider 3.105.0
• Slider, Gallery, and Carousel by MetaSlider 3.106.0