Slider by Soliloquy – Responsive Image Slider for WordPress <= 2.8.6 - Authenticated (Contributor+) Sensitive Information Exposure via Shortcode
- ID
- WPSEC-2026-2830
- Plugin
- Slider by Soliloquy – Responsive Image Slider for WordPress (soliloquy-lite)
- Affected
- all versions before 2.8.7
- Remediation
- Update to 2.8.7 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-10
- Attack surface
- Slider by Soliloquy – Responsive Image Slider for WordPress on WPSec AttackSurface
- Fix released
- Published
Description
The Slider by Soliloquy plugin for WordPress is vulnerable to Sensitive Information Exposure via the [soliloquy] shortcode in all versions up to, and including, 2.8.6 due to a missing authorization check on the status of the referenced slider. The shortcode rendered a slider referenced by ID in any status other than trash, including private, draft, pending and scheduled ones, without checking whether the current user may read it. This makes it possible for authenticated attackers, with contributor-level access and above, to embed the shortcode in a post, preview it and view the images, captions and titles of non-public sliders they cannot otherwise access.
References
- https://wpsec.com/vuln/WPSEC-2026-2830/
- https://plugins.svn.wordpress.org/soliloquy-lite/tags/2.8.7/
- https://wordpress.org/plugins/soliloquy-lite/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS