Slider Revolution CVE-2026-7542

Exploitation requires a valid WordPress account with at minimum Subscriber-level privileges, confirmed by the CVSS PR:L (low privileges required) vector component. The attacker must be able to obtain this account - either through open user registration, WooCommerce checkout account creation, membership plugin signup, or credential theft by other means. The Slider Revolution plugin version 7.0.10 or earlier must be installed and active on the target WordPress installation. No non-default plugin configuration is required - all three vulnerable code paths (nonce leak via admin_footer, $user_allowed allowlist entry, and unvalidated file:// path handling) are present in the default plugin installation. Target files must use extensions not present in the plugin's source extension blacklist; many sensitive file types are exploitable including .sql, .log, .json, .bak, .xml, .csv, .conf, .yml, .yaml, .pem, .key, .crt, .txt, and .db. The web server process must have filesystem read permission on the target file. Exploitation is limited by: (1) the requirement for at least subscriber-level authentication - purely unauthenticated exploitation is not supported per PR:L CVSS; (2) file extensions on the explicit blacklist (likely including .php) cannot be copied; (3) files unreadable by the web server process (e.g., owned by root with 600 permissions) cannot be exfiltrated.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) scores 6.5 and accurately characterizes the threat: network-reachable, low complexity, requiring only low-privilege authenticated access, with high confidentiality impact and no integrity or availability loss. No EPSS score was provided in the source data. The vulnerability is not listed in the CISA KEV catalog and no public exploit code has been identified, meaning the exploitation status is unconfirmed in the wild. Despite the moderate CVSS score, the real-world risk is elevated above what the numeric score implies for several reasons: all three flaws exist in default plugin behavior with no non-standard configuration required, subscriber-level accounts are trivially obtained on sites with open registration or WooCommerce/membership setups, and a successful attack yields direct access to high-value files such as wp-config.php (containing database credentials), SSL private keys, and application configuration files. The absence of integrity impact is accurate - the plugin copies rather than modifies source files - but the downstream impact of credential theft from wp-config.php could be total site compromise. The low attack complexity and no user interaction requirement mean exploitation is straightforward once credentials are in hand.

An attacker registers a subscriber-level WordPress account (or compromises existing subscriber credentials), loads any admin-context page to harvest the leaked revslider_actions nonce from the page footer JavaScript, then submits a crafted AJAX POST to wp-admin/admin-ajax.php specifying action=revslider_actions, client_action=wordpress.create.image_from_url, url=/var/www/html/wp-config.php, and content_type=text/plain. The plugin copies wp-config.php into /wp-content/uploads/revslider/ai/wp-config.txt, which the attacker retrieves via a plain HTTP GET - yielding database credentials and secret keys without any elevated privilege. No public exploit code has been identified at time of analysis, but the attack requires only standard HTTP tooling.