CVE-2026-7542 affects Slider Revolution plugin versions 7.0 to 7.0.10. The vulnerability arises from three main issues: (1) a valid backend AJAX nonce (revslider_actions) is leaked to all authenticated users including Subscribers via the admin_footer hook; (2) the wordpress.create.image_from_url action is allowlisted for non-administrator users, bypassing intended access controls; (3) the create_wordpress_image_from_url() function accepts an attacker-controlled URL parameter that is passed to import_media(), which allows local filesystem paths to be copied into a publicly accessible directory (/wp-content/uploads/revslider/ai/) without adequate validation. The MIME type check relies on an attacker-supplied content_type parameter and the blacklist of source extensions does not cover many sensitive file types, enabling attackers to expose contents of sensitive files by copying them to a public URL. The CVSS 3.1 base score is 6.5 (Medium severity) with network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality impact.

Authenticated users with Subscriber-level privileges or higher can read sensitive server files by exploiting the vulnerability. This leads to unauthorized disclosure of potentially sensitive information stored on the server, such as configuration files, logs, database dumps, and private keys, depending on file availability and extensions not blocked by the plugin. The integrity and availability of the system are not affected.

A patch is available for this vulnerability. Since this is a cloud-hosted service, the vendor manages remediation server-side. Users should verify with the vendor advisory that the patch has been applied. Until patched, restrict authenticated user roles and monitor for unusual file access patterns related to the plugin. Do not rely on the plugin's current MIME type or extension checks as they are insufficient.