# Slider by Soliloquy – Responsive Image Slider for WordPress <= 2.8.5 - Authenticated (Contributor+) Missing Authorization to Slider Data Disclosure via Slider Refresh AJAX Action

- **ID:** WPSEC-2026-1623
- **Plugin:** Slider by Soliloquy – Responsive Image Slider for WordPress (`soliloquy-lite`), https://wordpress.org/plugins/soliloquy-lite/
- **Affected versions:** all versions before 2.8.6
- **Fixed in:** 2.8.6 (Update to 2.8.6 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-25)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/soliloquy-lite
- **Fix released:** 2026-10-23
- **Published:** 2026-10-24
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1623/

## Description

The Slider by Soliloquy – Responsive Image Slider for WordPress plugin for WordPress is vulnerable to Missing Authorization via the soliloquy_refresh AJAX action in all versions up to, and including, 2.8.5, due to a missing object-level capability check. The refresh() function checks only the general edit_posts capability before loading the slides of the slider whose post ID the user supplies. This makes it possible for authenticated attackers, with contributor-level access and above, to read the slide data and admin markup (image titles, captions, links, alt text and HTML slide content) of sliders they are not allowed to edit, including draft, pending and private sliders owned by other users.

## References

- https://wpsec.com/vuln/WPSEC-2026-1623/
- https://plugins.svn.wordpress.org/soliloquy-lite/tags/2.8.6/
- https://wordpress.org/plugins/soliloquy-lite/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1623/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.