{
 "id": "WPSEC-2026-1843",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1843/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1843/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1843/index.md",
 "title": "Slider, Gallery, and Carousel by MetaSlider <= 3.113.1 - Authenticated (Editor+) Missing Authorization to Arbitrary Post Trashing and Deletion",
 "description": "The Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider plugin for WordPress is vulnerable to unauthorized post deletion via the slideshow list's bulk trash, restore and permanent delete actions in versions 3.31.0 to 3.113.1, due to a missing post type and per-post capability check on the supplied slideshow IDs. This makes it possible for authenticated attackers with the MetaSlider capability (editor-level access and above by default) to trash, publish or permanently delete arbitrary posts, including content types they are not otherwise allowed to delete.",
 "plugin": {
  "slug": "ml-slider",
  "name": "Slider, Gallery, and Carousel by MetaSlider",
  "full_name": "Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider",
  "wordpress_org": "https://wordpress.org/plugins/ml-slider/",
  "advisories_url": "https://wpsec.com/vuln/plugin/ml-slider/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/ml-slider"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 3.8,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L",
  "severity": "Low"
 },
 "affected": {
  "ranges": [
   {
    "from": "3.31.0",
    "from_inclusive": true,
    "to": "3.114.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 3.31.0 before 3.114.0"
  ]
 },
 "introduced_in": "3.31.0",
 "fixed_in": "3.114.0",
 "remediation": "Update to 3.114.0 or later.",
 "fix_released": "2026-10-27T14:05:40+00:00",
 "published": "2026-10-28T14:51:26+00:00",
 "updated": "2026-10-28T09:33:31.245027+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1843/",
  "https://plugins.svn.wordpress.org/ml-slider/tags/3.114.0/",
  "https://wordpress.org/plugins/ml-slider/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/ml-slider",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "High",
  "affected_versions": "High",
  "as_of": "2026-10-28"
 }
}