Slider, Gallery, and Carousel by MetaSlider <= 3.113.1 - Authenticated (Editor+) Missing Authorization to Arbitrary Post Trashing and Deletion

ID

WPSEC-2026-1843

Plugin

Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider (ml-slider)

Affected

from 3.31.0 before 3.114.0

Remediation

Update to 3.114.0 or later.

CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L

Weakness

CWE-862

Usage

Plugin High · Affected versions High among sites WPSec scans, 2026-10-28

Attack surface

Slider, Gallery, and Carousel by MetaSlider on WPSec AttackSurface

Fix released

2026-10-27

Published

2026-10-28

Description

The Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider plugin for WordPress is vulnerable to unauthorized post deletion via the slideshow list's bulk trash, restore and permanent delete actions in versions 3.31.0 to 3.113.1, due to a missing post type and per-post capability check on the supplied slideshow IDs. This makes it possible for authenticated attackers with the MetaSlider capability (editor-level access and above by default) to trash, publish or permanently delete arbitrary posts, including content types they are not otherwise allowed to delete.

References

• https://wpsec.com/vuln/WPSEC-2026-1843/
• https://plugins.svn.wordpress.org/ml-slider/tags/3.114.0/
• https://wordpress.org/plugins/ml-slider/

Published by WPSec. Provided as is, without warranty. Corrections: contact us.

This advisory as JSON or Markdown · All advisories: JSON, RSS