CVE-2026-9050
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
The Slider Revolution plugin for WordPress versions 6.0.0-6.7.55 and 7.0.0-7.0.14 is vulnerable to unauthorized data modification. Lack of permission verification allows authenticated attackers with Contributor-level access or higher to deactivate any active plugin on the site.
Risk Assessment
An attacker can deactivate critical plugins, leading to site downtime or loss of security features.
Recommendation
Update the Slider Revolution plugin to the latest available version.
Other vulnerabilities in Slider Revolution
See all- CVE-2026-57678High
The Slider Revolution plugin versions 7.0.0 through 7.0.16 contain a reflected Cross-site Scripting (XSS) vulnerability due to improper input neutralization during web page generation. An attacker can inject a malicious script into an HTTP request that will be executed in the victim's browser.
- CVE-2026-7542Medium
The Slider Revolution plugin for WordPress versions 7.0 to 7.0.10 allows sensitive information disclosure. Authenticated attackers with Subscriber-level access can read server files (e.g., .sql, .log, .json) by copying them to a publicly accessible directory.
- CVE-2026-9048Medium
The Slider Revolution plugin for WordPress versions 7.0.0 – 7.0.14 exposes sensitive data via the 'slider.get.full' AJAX action. Authenticated attackers with Contributor-level access or higher can extract raw social media API credentials, including Instagram OAuth token, Flickr API key, YouTube Data API key, and Facebook App ID.
- CVE-2026-6728Medium
The Slider Revolution plugin for WordPress up to version 7.0.9 has a sensitive information exposure vulnerability via the 'get_stream_data()' function. Unauthenticated attackers can extract data including password-protected post, page, and product content.
Original NVD description (English source)
The Slider Revolution plugin for WordPress in versions 6.0.0-6.7.55 and 7.0.0-7.0.14 is vulnerable to unauthorized modification of data. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with Contributor-level access and above, to deactivate any active plugin installed on the site.