What is the CVSS score of CVE-2026-6728?

CVE-2026-6728 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Slider Revolution CVE-2026-6728

EUVD-2026-31089 MEDIUM

Information Exposure (CWE-200)

2026-05-20 security@wordfence.com

GHSA-hch9-c8w4-xh4q

Information Disclosure WordPress

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 20, 2026 - 10:35 vuln.today

DescriptionCVE.org

The Slider Revolution plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 7.0.9 via the 'get_stream_data()' function. This makes it possible for unauthenticated attackers to extract sensitive data including published password-protected post, page, and product content.

AnalysisAI

Sensitive information exposure in the Slider Revolution WordPress plugin (versions up to and including 7.0.9) allows unauthenticated remote attackers to bypass WordPress's native password-protection mechanism and retrieve the full content of protected posts, pages, and WooCommerce products via the vulnerable get_stream_data() function. The CVSS vector confirms no authentication, no user interaction, and no special conditions are required, making this trivially exploitable against any affected installation. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

Slider Revolution is a widely deployed WordPress slider/presentation plugin. The vulnerability resides in the get_stream_data() function, which fails to enforce WordPress's built-in content visibility controls before returning post, page, or product data. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) describes the root cause: the function does not check whether the requesting user has the necessary capability or has authenticated with the content's password before streaming content. This is a classic access-control bypass at the application layer - WordPress exposes REST or AJAX endpoints through which plugins can serve data, and if the plugin does not validate the password-protection status of the queried content, the framework's protection is silently circumvented. Affected CPE is not formally enumerated in the provided data, but the plugin is identified as Slider Revolution for WordPress, versions ≤ 7.0.9.

RemediationAI

Update the Slider Revolution plugin to a version beyond 7.0.9 as documented in the vendor changelog at https://www.sliderrevolution.com/changelog/. The exact patched release version is not independently confirmed from the available data - verify the current release version prior to deploying. As a compensating control while patching is pending, administrators can restrict access to WordPress AJAX and REST endpoints at the web server or WAF layer for unauthenticated requests, though this may break legitimate slider functionality and should be tested in a staging environment. Alternatively, temporarily avoid storing sensitive content behind password-protected posts if the plugin cannot be updated immediately. There are no known side-effect-free workarounds that do not impair plugin functionality - updating to the patched version is the only confirmed remediation.