Slider, Gallery, and Carousel by MetaSlider <= 3.113.1 - Authenticated (Editor+) Missing Authorization to Arbitrary Post Modification
- ID
- WPSEC-2026-1844
- Plugin
- Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider (ml-slider)
- Affected
- all versions before 3.114.0
- Remediation
- Update to 3.114.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-10-28
- Attack surface
- Slider, Gallery, and Carousel by MetaSlider on WPSec AttackSurface
- Fix released
- Published
Description
The Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider plugin for WordPress is vulnerable to unauthorized modification of data via the REST save_slideshow route and the image, Livid and local video slide AJAX handlers (create, duplicate, resize, crop position, image update, video source, track and cover) in all versions up to, and including, 3.113.1, due to missing checks that the supplied slide_id and slider_id are MetaSlider slides and slideshows the user can edit. This makes it possible for authenticated attackers with the MetaSlider capability (editor-level access and above by default) to change the excerpt, menu order and selected post meta (such as image alt text, crop position and the featured image) of arbitrary posts, and to copy arbitrary posts into new posts.
References
- https://wpsec.com/vuln/WPSEC-2026-1844/
- https://plugins.svn.wordpress.org/ml-slider/tags/3.114.0/
- https://wordpress.org/plugins/ml-slider/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS