CVE-2026-6728
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
The Slider Revolution plugin for WordPress up to version 7.0.9 has a sensitive information exposure vulnerability via the 'get_stream_data()' function. Unauthenticated attackers can extract data including password-protected post, page, and product content.
Risk Assessment
An attacker can access content intended only for authorized users, potentially leading to leakage of confidential business information or privacy violations.
Recommendation
Update the Slider Revolution plugin to version 7.0.10 or later, which restricts access to the get_stream_data() function.
Other vulnerabilities in Slider Revolution
See all- CVE-2026-57678High
The Slider Revolution plugin versions 7.0.0 through 7.0.16 contain a reflected Cross-site Scripting (XSS) vulnerability due to improper input neutralization during web page generation. An attacker can inject a malicious script into an HTTP request that will be executed in the victim's browser.
- CVE-2026-7542Medium
The Slider Revolution plugin for WordPress versions 7.0 to 7.0.10 allows sensitive information disclosure. Authenticated attackers with Subscriber-level access can read server files (e.g., .sql, .log, .json) by copying them to a publicly accessible directory.
- CVE-2026-9050Medium
The Slider Revolution plugin for WordPress versions 6.0.0-6.7.55 and 7.0.0-7.0.14 is vulnerable to unauthorized data modification. Lack of permission verification allows authenticated attackers with Contributor-level access or higher to deactivate any active plugin on the site.
- CVE-2026-9048Medium
The Slider Revolution plugin for WordPress versions 7.0.0 – 7.0.14 exposes sensitive data via the 'slider.get.full' AJAX action. Authenticated attackers with Contributor-level access or higher can extract raw social media API credentials, including Instagram OAuth token, Flickr API key, YouTube Data API key, and Facebook App ID.
Original NVD description (English source)
The Slider Revolution plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 7.0.9 via the 'get_stream_data()' function. This makes it possible for unauthenticated attackers to extract sensitive data including published password-protected post, page, and product content.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS