CVE-2026-6728

Vulnerability

The Slider Revolution plugin for WordPress versions up to and including 7.0.9 contains a sensitive information exposure vulnerability in the get_stream_data() function [1]. This function does not properly check user permissions before returning data, allowing unauthenticated attackers to retrieve published password-protected post, page, and product content.

Exploitation

An attacker can exploit this vulnerability without any authentication by sending crafted requests that trigger the get_stream_data() function [1]. No special network position or user interaction is required; the attacker only needs to be able to send HTTP requests to the WordPress site.

Impact

Successful exploitation allows an unauthenticated attacker to extract sensitive data, including the full content of published posts, pages, and products that are protected with a password [1]. This information disclosure undermines the intended access controls of the WordPress site.

Mitigation

The vulnerability is patched in version 7.0.14, which is compatible with WordPress 6.9 [1]. Users should update Slider Revolution to the latest available version. No workaround is documented in the provided references.