CVE-2026-7542: Slider Revolution Information Disclosure

CVE-2026-7542 Overview

CVE-2026-7542 affects the Slider Revolution plugin for WordPress in versions up to and including 7.0.10. Authenticated attackers with Subscriber-level access can read arbitrary server files by abusing the wordpress.create.image_from_url AJAX action. The plugin leaks a valid backend AJAX nonce (revslider_actions) to all authenticated users through the admin_footer hook. The action is incorrectly allowlisted in the $user_allowed array, bypassing administrator-only access controls. Targeted files are copied into the publicly accessible /wp-content/uploads/revslider/ai/ directory, exposing their contents over HTTP. This issue is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact

Authenticated Subscriber-level users can exfiltrate sensitive server files including .sql, .log, .json, .bak, .xml, .csv, .conf, .yml, .pem, .key, .crt, .txt, and .db files by causing them to be copied to a public web directory.

Affected Products

• Slider Revolution plugin for WordPress, versions up to and including 7.0.10
• WordPress sites with Subscriber-or-higher user registration enabled
• Any deployment where the affected plugin is installed and activated

Discovery Timeline

• 2026-06-09 - CVE-2026-7542 published to NVD
• 2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-7542

Vulnerability Analysis

The vulnerability stems from three compounding design flaws in the Slider Revolution plugin. First, the plugin exposes a valid backend AJAX nonce named revslider_actions to every authenticated user, including Subscribers, via the admin_footer hook. Second, the wordpress.create.image_from_url action is explicitly added to the $user_allowed array, which bypasses the administrator-only access control gate. Third, the underlying create_wordpress_image_from_url() function accepts an attacker-controlled url parameter without restricting input to remote HTTP or HTTPS schemes.

The url value is forwarded to import_media(), where path_or_url_exists() validates input using file_exists() and is_readable(). These checks return true for local filesystem paths. The plugin then invokes @copy() to write the file into /wp-content/uploads/revslider/ai/, which is served directly to anonymous web visitors. The destination extension is derived from the attacker-supplied content_type parameter rather than the file's actual MIME signature.

Root Cause

The root cause is a combination of broken access control and missing input validation. The plugin trusts Subscriber-level users with a nonce intended for administrators. The file ingestion routine performs no scheme validation on the supplied URL, treating local paths as valid sources. The source-extension blacklist is incomplete and fails to block sensitive file types such as .sql, .log, .json, .bak, .pem, .key, and .crt.

Attack Vector

An authenticated attacker with Subscriber privileges reads the leaked revslider_actions nonce from the admin footer. The attacker then issues an AJAX request invoking the wordpress.create.image_from_url action with a local filesystem path such as /var/www/html/wp-config.php as the url parameter. The plugin copies the target file into /wp-content/uploads/revslider/ai/ with an attacker-chosen extension derived from the content_type parameter. The attacker retrieves the file contents anonymously over HTTP from the public uploads directory.

See the Wordfence Vulnerability Analysis for additional technical detail.

Detection Methods for CVE-2026-7542

Indicators of Compromise

• Unexpected files appearing in /wp-content/uploads/revslider/ai/, particularly files with non-image content or unusual extensions
• HTTP POST requests to admin-ajax.php containing action=revslider_ajax_action and client_action=create_wordpress_image_from_url originating from low-privilege user sessions
• AJAX requests where the url parameter contains local filesystem paths such as /etc/, /var/, or wp-config.php rather than HTTP or HTTPS URLs
• Anonymous GET requests retrieving files from /wp-content/uploads/revslider/ai/ shortly after Subscriber-account activity

Detection Strategies

• Audit web server access logs for requests to /wp-content/uploads/revslider/ai/ and correlate against the originating uploader's role
• Inspect admin-ajax.php traffic for the create_wordpress_image_from_url client action invoked by non-administrator accounts
• Hash and inventory files in the revslider/ai/ directory to identify content that does not match declared MIME types

Monitoring Recommendations

• Enable WordPress audit logging to capture AJAX action invocations and the associated user role
• Alert on Subscriber-level accounts issuing privileged AJAX actions or accessing the Slider Revolution admin endpoints
• Monitor outbound copies of sensitive files such as wp-config.php, database dumps, and private keys appearing in publicly served directories

How to Mitigate CVE-2026-7542

Immediate Actions Required

• Update Slider Revolution to a version later than 7.0.10 as listed in the Slider Revolution Changelog
• Audit user accounts and remove unnecessary Subscriber-level registrations, especially on sites that do not require open registration
• Review the /wp-content/uploads/revslider/ai/ directory for unauthorized files and rotate any credentials, API keys, or certificates that may have been exposed
• Rotate WordPress salts, database credentials, and any secrets stored in wp-config.php if exposure is suspected

Patch Information

The vendor addressed the issue in a release subsequent to 7.0.10. Refer to the Slider Revolution Changelog for the specific fixed version. The Wordfence Vulnerability Analysis provides remediation guidance.

Workarounds

• Disable open user registration on the WordPress site if Subscriber accounts are not required
• Restrict access to /wp-content/uploads/revslider/ai/ via web server rules until the plugin is updated
• Deploy a Web Application Firewall rule blocking AJAX requests where client_action=create_wordpress_image_from_url and the url parameter does not begin with http:// or https://
• Temporarily deactivate the Slider Revolution plugin on sites that cannot apply the patch immediately

# Configuration example: deny direct access to the affected upload directory via .htaccess
# Place in /wp-content/uploads/revslider/ai/.htaccess
<FilesMatch "\.(sql|log|json|bak|xml|csv|conf|yml|yaml|pem|key|crt|txt|db|php)$">
    Require all denied
</FilesMatch>