Slider by Soliloquy – Responsive Image Slider for WordPress <= 2.8.5 - Authenticated (Contributor+) Missing Authorization to Slider Data Disclosure via Slider Refresh AJAX Action
- ID
- WPSEC-2026-1623
- Plugin
- Slider by Soliloquy – Responsive Image Slider for WordPress (soliloquy-lite)
- Affected
- all versions before 2.8.6
- Remediation
- Update to 2.8.6 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-25
- Attack surface
- Slider by Soliloquy – Responsive Image Slider for WordPress on WPSec AttackSurface
- Fix released
- Published
Description
The Slider by Soliloquy – Responsive Image Slider for WordPress plugin for WordPress is vulnerable to Missing Authorization via the soliloquy_refresh AJAX action in all versions up to, and including, 2.8.5, due to a missing object-level capability check. The refresh() function checks only the general edit_posts capability before loading the slides of the slider whose post ID the user supplies. This makes it possible for authenticated attackers, with contributor-level access and above, to read the slide data and admin markup (image titles, captions, links, alt text and HTML slide content) of sliders they are not allowed to edit, including draft, pending and private sliders owned by other users.
References
- https://wpsec.com/vuln/WPSEC-2026-1623/
- https://plugins.svn.wordpress.org/soliloquy-lite/tags/2.8.6/
- https://wordpress.org/plugins/soliloquy-lite/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS