Slider - Ultimate Responsive Image Slider < 3.5.12 - Subscriber+ Arbitrary Post Access

Vulnerability

The Slider – Ultimate Responsive Image Slider plugin for WordPress, versions before 3.5.12, fails to verify that a post requested via an AJAX action is a slide and that the requesting user has permission to view it. This allows any authenticated user, including subscribers, to access arbitrary posts, including private, draft, and password-protected content [1].

Exploitation

An attacker must be authenticated as a user with at least the Subscriber role. By sending a crafted AJAX request to the vulnerable endpoint with a target post ID, the attacker can retrieve the content of any post without proper authorization. No additional user interaction is required [1].

Impact

Successful exploitation leads to unauthorized disclosure of sensitive information. An attacker can read private posts, draft content, and password-protected posts, potentially exposing confidential data or internal communications [1].

Mitigation

The vulnerability is fixed in version 3.5.12 of the plugin. Users should update to this version immediately. No workarounds are documented in the available reference [1].