The Slider Revolution plugin for WordPress is vulnerable to sensitive information exposure in versions 7.0.0 through 7.0.14. The flaw is triggered via the 'slider.get.full' AJAX action, which allows authenticated users with Contributor or higher roles to retrieve raw social media API credentials—such as Instagram OAuth tokens, Flickr API keys, YouTube Data API keys, and Facebook App IDs—from slider settings. This directly compromises confidentiality of those credentials, potentially enabling attackers to access the associated external services.

WordPress sites that have the Slider Revolution plugin installed in any version from 7.0.0 to 7.0.14 are affected. Site owners should check the installed plugin version and ensure it falls outside the vulnerable range.

The CVSS score of 4.3 indicates moderate severity. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog. Successful exploitation requires an attacker to first obtain an authenticated user account with Contributor-level access or higher. Once authenticated, the attacker can download sensitive credentials that may be used to compromise external social media accounts or other services. The overall risk remains moderate, and site owners with contributor accounts should apply the fix promptly.