CVE-2026-6728: Slider Revolution Information Disclosure

CVE-2026-6728 Overview

CVE-2026-6728 is a Sensitive Information Exposure vulnerability in the Slider Revolution plugin for WordPress. The flaw exists in the get_stream_data() function and affects all plugin versions up to and including 7.0.9. Unauthenticated attackers can extract sensitive data over the network, including content from published password-protected posts, pages, and WooCommerce products. The issue is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. No authentication or user interaction is required to exploit the weakness.

Critical Impact

Unauthenticated remote attackers can read the contents of password-protected WordPress posts, pages, and products, bypassing the access control intended for paywalled or private content.

Affected Products

• Slider Revolution plugin for WordPress versions <= 7.0.9
• WordPress sites using Slider Revolution to display protected content
• WooCommerce stores relying on Slider Revolution for product showcases with password-protected products

Discovery Timeline

• 2026-05-20 - CVE-2026-6728 published to NVD
• 2026-05-20 - Last updated in NVD database

Technical Details for CVE-2026-6728

Vulnerability Analysis

The Slider Revolution plugin exposes a get_stream_data() function that returns content streams used by slider modules to render dynamic data. The function fails to enforce post visibility checks before returning content. As a result, posts protected by WordPress's built-in password mechanism are returned in cleartext to any caller. Attackers do not need credentials, cookies, or user interaction to reach the endpoint. The impact is limited to confidentiality, with no integrity or availability effects, as reflected by the CVSS confidentiality-only vector.

Root Cause

The root cause is missing authorization and visibility enforcement within get_stream_data(). WordPress treats password-protected posts as published but gates their content behind a password cookie check via post_password_required(). The plugin's stream handler appears to query post content directly without invoking that check or filtering out protected items. This pattern is a common source of [CWE-200] disclosures in plugins that bypass core WordPress content APIs.

Attack Vector

Exploitation occurs over the network against any WordPress site running a vulnerable Slider Revolution version. An attacker issues an unauthenticated request to the stream data endpoint exposed by the plugin. The response includes serialized post content that should be gated by password protection. No privileges, tokens, or social engineering are required. Refer to the Wordfence Vulnerability Intel entry for additional technical context.

// No verified public exploit code is available at the time of publication.
// See vendor changelog and Wordfence advisory for technical detail.

Detection Methods for CVE-2026-6728

Indicators of Compromise

• Unauthenticated HTTP requests to admin-ajax.php or REST endpoints invoking Slider Revolution get_stream_data actions from unknown IP addresses.
• High-volume or scripted access patterns targeting Slider Revolution endpoints from a single source.
• Anomalous outbound transfer of post content sizes in HTTP responses originating from the plugin's stream handler.

Detection Strategies

• Inventory installed Slider Revolution versions across all WordPress hosts and flag any instance at 7.0.9 or earlier.
• Enable web server access logging and search for request paths or action parameters referencing get_stream_data or Slider Revolution stream endpoints.
• Deploy a Web Application Firewall (WAF) rule that monitors unauthenticated access to plugin AJAX and REST routes returning post bodies.

Monitoring Recommendations

• Forward WordPress access logs and PHP error logs to a centralized SIEM for correlation against unauthenticated plugin endpoint usage.
• Alert on spikes in 200-status responses to Slider Revolution endpoints originating from non-browser User-Agent strings.
• Track outbound response sizes for the plugin's stream URLs to identify bulk content scraping activity.

How to Mitigate CVE-2026-6728

Immediate Actions Required

• Update Slider Revolution to the patched release listed in the Slider Revolution Changelog immediately.
• Audit any password-protected posts, pages, or WooCommerce products served by the affected site for potential prior exposure.
• Rotate any secrets, coupon codes, or unreleased content that may have been embedded in password-protected posts.

Patch Information

The vendor addressed the issue in a release after 7.0.9. Site administrators should consult the Slider Revolution Changelog for the specific fixed version and apply the upgrade through the WordPress plugin updater or by replacing the plugin files manually. Verify the installed version after upgrade by checking the plugin metadata in wp-admin.

Workarounds

• Temporarily deactivate the Slider Revolution plugin until the patched version can be installed.
• Restrict access to the plugin's AJAX and REST endpoints at the WAF or reverse proxy layer for unauthenticated requests.
• Remove sensitive content from password-protected posts that are rendered through Slider Revolution sliders until patching is complete.

# Example: block unauthenticated access to Slider Revolution stream actions at the web server
# nginx snippet
location = /wp-admin/admin-ajax.php {
    if ($arg_action ~* "revslider|get_stream_data") {
        return 403;
    }
}