CVE-2026-9048 describes an authorization flaw in the Slider Revolution WordPress plugin affecting versions 7.0.0 through 7.0.14. The flaw allows authenticated users with Contributor-level privileges or higher to exploit the 'slider.get.full' AJAX action to retrieve sensitive configuration data, including various social media API credentials stored within slider settings. This exposure could lead to unauthorized access to these external services if the credentials are misused. The vulnerability is categorized under CWE-863 (Incorrect Authorization). No known exploits are reported in the wild, and no vendor remediation level or patch is currently documented.

The vulnerability allows unauthorized disclosure of sensitive information, specifically social media API credentials, to authenticated users with Contributor-level access or above. This could potentially lead to misuse of these credentials outside the WordPress environment. However, the impact is limited to confidentiality and does not affect integrity or availability. The CVSS score of 4.3 reflects a medium severity level due to the requirement for authenticated access and limited scope of impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access to trusted users only and consider auditing user roles and permissions. Monitor for updates from the vendor regarding patches or official mitigations.