# Slider by Soliloquy – Responsive Image Slider for WordPress <= 2.8.6 - Authenticated (Contributor+) Sensitive Information Exposure via Shortcode

- **ID:** WPSEC-2026-2830
- **Plugin:** Slider by Soliloquy – Responsive Image Slider for WordPress (`soliloquy-lite`), https://wordpress.org/plugins/soliloquy-lite/
- **Affected versions:** all versions before 2.8.7
- **Fixed in:** 2.8.7 (Update to 2.8.7 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-10)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/soliloquy-lite
- **Fix released:** 2026-11-09
- **Published:** 2026-11-10
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2830/

## Description

The Slider by Soliloquy plugin for WordPress is vulnerable to Sensitive Information Exposure via the [soliloquy] shortcode in all versions up to, and including, 2.8.6 due to a missing authorization check on the status of the referenced slider. The shortcode rendered a slider referenced by ID in any status other than trash, including private, draft, pending and scheduled ones, without checking whether the current user may read it. This makes it possible for authenticated attackers, with contributor-level access and above, to embed the shortcode in a post, preview it and view the images, captions and titles of non-public sliders they cannot otherwise access.

## References

- https://wpsec.com/vuln/WPSEC-2026-2830/
- https://plugins.svn.wordpress.org/soliloquy-lite/tags/2.8.7/
- https://wordpress.org/plugins/soliloquy-lite/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2830/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.