Theme plugin has a security vulnerability -> no update

Envato Customers Web and Code
1

Hi there,

For a client I’m using the WP theme: MobRepair - Mobile Phone Repair Services WordPress Theme: MobRepair - Mobile Phone Repair Services WordPress Theme by BrothersTheme.

The theme came with the plugin ‘Slider revolution’, but this plugin has a major security vulnerability for all versions below 6.6.15: Slider Revolution <= 6.6.15 - Authenticated (Author+) Arbitrary File Upload.

Although my support is expired, I’ve tried to contact the theme author about two weeks ago, but no response. About 6 days ago I wrote a comment on their theme page, but also no reaction and I saw the last 3 comments were actually mine :slight_smile:

Is it normal to not receive support for such security vulnerability’s? I really need a patched version of the plugin.

Elias

2

As it says:

This makes it possible for attackers with author-level access and higher to upload arbitrary files on the affected site’s server which may make remote code execution possible.

They will still need author-level privileges. If you don’t have any author level or higher user, you are OK.