What is the CVSS score of CVE-2026-9048?

CVE-2026-9048 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Slider Revolution CVE-2026-9048

EUVD-2026-33851 MEDIUM

Incorrect Authorization (CWE-863)

2026-06-02 security@wordfence.com

GHSA-qp4q-9v3r-37r2

Information Disclosure WordPress Authentication Bypass

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 02, 2026 - 00:35 vuln.today

CVE Published

Jun 02, 2026 - 00:16 nvd

MEDIUM 4.3

DescriptionCVE.org

The Slider Revolution plugin for WordPress is vulnerable to Sensitive Information Exposure in versions 7.0.0 - 7.0.14, via the 'slider.get.full' AJAX Action. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including raw social media API credentials: the Instagram OAuth token, Flickr API key, YouTube Data API key, and Facebook App ID, stored in any configured slider's settings.

AnalysisAI

Slider Revolution WordPress plugin versions 7.0.0 through 7.0.14 exposes raw social media API credentials - including Instagram OAuth tokens, Flickr API keys, YouTube Data API keys, and Facebook App IDs - to any authenticated user holding Contributor-level access or higher. The flaw stems from insufficient authorization controls on the 'slider.get.full' AJAX action, which returns full slider configuration data without verifying whether the requesting user should have access to sensitive credential fields. No public exploit has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog, but the real-world impact of credential theft for active social media integrations exceeds what the medium CVSS score alone suggests.

Technical ContextAI

Slider Revolution is a widely deployed WordPress visual builder plugin used for creating animated sliders and content sections. The affected functionality is a server-side AJAX handler registered under the action 'slider.get.full', which retrieves complete slider configuration objects including stored third-party API credentials used for social media feed integrations. The root cause is classified as CWE-863 (Incorrect Authorization): the handler authenticates the WordPress nonce and session, confirming the user is logged in, but fails to apply capability checks that would restrict full configuration data - including plaintext credential fields - to administrative roles only. Contributor-level users in WordPress have legitimate access to post creation but should have no access to plugin configuration or stored API secrets. The CVSS vector AV:N/AC:L/PR:L/UI:N confirms this is a low-complexity, network-reachable flaw requiring only a low-privilege account, with no user interaction needed.

RemediationAI

Update the Slider Revolution plugin to a version beyond 7.0.14; versions 7.0.0 through 7.0.14 are confirmed affected per the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/e4396411-57a2-4bef-9dfb-cbcdc1292de0. An exact patched release version was not independently confirmed in the available input data - the upper bound of 7.0.14 implies the fix is in a subsequent release, but verify the changelog at https://www.sliderrevolution.com/ before deploying. As an immediate compensating control where patching is delayed, revoke and rotate all social media API credentials stored in Slider Revolution's configuration (Instagram OAuth token, Flickr API key, YouTube Data API key, Facebook App ID), since any contributor-level account on the site may have already accessed them. Additionally, restrict WordPress site registration and contributor role assignment to trusted users only, and consider temporarily disabling social media feed integrations until the patch is applied. Note that rotating credentials will temporarily break any active social feed widgets until new credentials are configured.