CVE-2026-6728 is a medium severity vulnerability in the Slider Revolution WordPress plugin (versions up to 7.0.9) caused by improper access control in the get_stream_data() function. This flaw permits unauthenticated attackers to retrieve sensitive data, including password-protected published content such as posts, pages, and products. The vulnerability is categorized under CWE-200 (Exposure of Sensitive Information). The CVSS 3.1 vector indicates the attack can be performed remotely without authentication or user interaction, impacting confidentiality but not integrity or availability. No vendor advisory or patch information is currently available, and no exploits are known in the wild.

An attacker can remotely access sensitive information that should be protected, including password-protected content published via the Slider Revolution plugin. This exposure compromises confidentiality but does not affect integrity or availability. The vulnerability does not require authentication or user interaction, increasing its risk profile. However, no known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the affected plugin or disabling it if feasible. Monitor for vendor updates regarding patches or mitigations specific to this vulnerability.