The Slider Revolution plugin for WordPress is vulnerable to a sensitive information exposure flaw. Exploiting the get_stream_data() function via the sliders/stream endpoint allows unauthenticated attackers to retrieve content that is normally protected by passwords, including posts, pages, and product data. This cross‑site information leak demonstrates a CWE-200 weakness where authentication checks are omitted before processing the request.

Any WordPress site that runs Slider Revolution version 7.0.9 or earlier is affected. The vulnerability is tied to the plugin itself, regardless of the hosting environment or other installed components.

The CVSS score of 5.3 indicates moderate severity. The EPSS score is not published, and the vulnerability is not listed in CISA's KEV catalog, suggesting that large‑scale exploitation has not yet been observed. However, the attack vector is straightforward: an unauthenticated HTTP request to the sliders/stream endpoint can be crafted without special credentials or local access. Once accessed, the attacker can read protected content, potentially exposing sensitive business or customer information. The risk to confidentiality is significant, while availability impact is minimal.