PT-2026-42137 · WordPress · Slider Revolution

Mostafa · CVE-2026-6728 · Published 2026-05-20 · Updated 2026-05-20

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Slider Revolution versions prior to 7.1.0

Description The Slider Revolution plugin for WordPress allows unauthenticated attackers to extract sensitive data, including published password-protected post, page, and product content. This occurs through the 'sliders/stream' endpoint via the get stream data() function.

Recommendations Update to a version later than 7.0.9. As a temporary workaround, restrict access to the get stream data() function.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2026-6728

Affected Products

Slider Revolution

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-6728 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/3cd7be2c-9ba9-4d25-8907-610898df5834?source=cve · Note
• https://sliderrevolution.com/changelog · Note
• https://t.me/CVEtracker/54377 · Telegram Post