CVE-2026-9048

Name of the Vulnerable Software and Affected Versions Slider Revolution versions 7.0.0 through 7.0.14

Description An issue exists where authenticated attackers with Contributor-level access or higher can extract sensitive data. This is achieved via the 'slider.get.full' AJAX Action, allowing the retrieval of raw social media API credentials stored in slider settings, specifically the Instagram OAuth token, Flickr API key, YouTube Data API key, and Facebook App ID.

Recommendations Update Slider Revolution to a version later than 7.0.14. As a temporary workaround, restrict access to the 'slider.get.full' AJAX Action for users with Contributor-level permissions.