# Slider, Gallery, and Carousel by MetaSlider <= 3.113.1 - Authenticated (Editor+) Missing Authorization to Arbitrary Post Modification

- **ID:** WPSEC-2026-1844
- **Plugin:** Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider (`ml-slider`), https://wordpress.org/plugins/ml-slider/
- **Affected versions:** all versions before 3.114.0
- **Fixed in:** 3.114.0 (Update to 3.114.0 or later.)
- **Severity:** Low 2.7 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin High, affected versions High (as of 2026-10-28)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/ml-slider
- **Fix released:** 2026-10-27
- **Published:** 2026-10-28
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1844/

## Description

The Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider plugin for WordPress is vulnerable to unauthorized modification of data via the REST save_slideshow route and the image, Livid and local video slide AJAX handlers (create, duplicate, resize, crop position, image update, video source, track and cover) in all versions up to, and including, 3.113.1, due to missing checks that the supplied slide_id and slider_id are MetaSlider slides and slideshows the user can edit. This makes it possible for authenticated attackers with the MetaSlider capability (editor-level access and above by default) to change the excerpt, menu order and selected post meta (such as image alt text, crop position and the featured image) of arbitrary posts, and to copy arbitrary posts into new posts.

## References

- https://wpsec.com/vuln/WPSEC-2026-1844/
- https://plugins.svn.wordpress.org/ml-slider/tags/3.114.0/
- https://wordpress.org/plugins/ml-slider/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1844/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.