The Slider Revolution plugin for WordPress suffers from a combination of design flaws that allow authenticated users with Subscriber level access or higher to gain sensitive information. The plugin exposes a valid backend AJAX nonce in the front‑end, bypasses the intended administrator‑only access control for the wordpress.create.image_from_url action, and accepts attacker‑controlled URLs that can be copied into the public uploads directory. By supplying a local filesystem path, an attacker can cause the plugin to copy sensitive files such as .sql, .conf, or .pem into a publicly accessible location, enabling direct download of those files.

Affects the Revolution Slider plugin, Slider Revolution , and all WordPress sites that have the plugin installed in a version up to and including 7.0.10. Any authenticated user, even those with just Subscriber privileges, can exploit the vulnerability, so the impact spans all sites using the vulnerable version of the plugin.

The CVSS score of 6.5 indicates a moderate to high risk, and the absence of an EPSS score and KEV listing suggests the vulnerability is not yet widely exploited in the public domain. The attack requires only authentication and sufficient access to the plugin’s AJAX interface, which is available to all logged‑in users. Exploitation leads to the disclosure of arbitrary non‑blacklisted server files, but does not allow arbitrary code execution. Administrators should consider the vulnerability significant enough to warrant immediate remediation.