{
 "id": "WPSEC-2026-2830",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2830/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2830/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2830/index.md",
 "title": "Slider by Soliloquy – Responsive Image Slider for WordPress <= 2.8.6 - Authenticated (Contributor+) Sensitive Information Exposure via Shortcode",
 "description": "The Slider by Soliloquy plugin for WordPress is vulnerable to Sensitive Information Exposure via the [soliloquy] shortcode in all versions up to, and including, 2.8.6 due to a missing authorization check on the status of the referenced slider. The shortcode rendered a slider referenced by ID in any status other than trash, including private, draft, pending and scheduled ones, without checking whether the current user may read it. This makes it possible for authenticated attackers, with contributor-level access and above, to embed the shortcode in a post, preview it and view the images, captions and titles of non-public sliders they cannot otherwise access.",
 "plugin": {
  "slug": "soliloquy-lite",
  "name": "Slider by Soliloquy – Responsive Image Slider for WordPress",
  "full_name": "Slider by Soliloquy – Responsive Image Slider for WordPress",
  "wordpress_org": "https://wordpress.org/plugins/soliloquy-lite/",
  "advisories_url": "https://wpsec.com/vuln/plugin/soliloquy-lite/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/soliloquy-lite"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.8.7",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.8.7"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.8.7",
 "remediation": "Update to 2.8.7 or later.",
 "fix_released": "2026-11-09T21:27:30+00:00",
 "published": "2026-11-10T21:42:30+00:00",
 "updated": "2026-11-10T00:16:14.880796+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2830/",
  "https://plugins.svn.wordpress.org/soliloquy-lite/tags/2.8.7/",
  "https://wordpress.org/plugins/soliloquy-lite/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/soliloquy-lite",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-10"
 }
}