CVE-2026-7636

Vulnerability

The Slider by Soliloquy – Responsive Image Slider for WordPress plugin is vulnerable to Sensitive Information Exposure in all versions up to and including 2.8.1. The flaw resides in the map_meta_cap function within the Soliloquy_Posttype_Lite class, which improperly handles capability checks for draft slider posts. This allows unauthorized access to metadata of sliders that are not yet published, including unpublished media URLs, captions, and slider configuration authored by administrators or editors [2].

Exploitation

An attacker must be authenticated with at least subscriber-level access to the WordPress site. No additional privileges or user interaction are required. The attacker can exploit the vulnerability by sending crafted requests that leverage the insufficient capability checks in map_meta_cap, thereby retrieving draft slider metadata that should be restricted to higher-privileged users.

Impact

Successful exploitation leads to the exposure of sensitive information: unpublished media URLs (which may reveal private or draft images), captions, and slider configuration details. This information disclosure could aid further attacks or leak confidential content. The attacker does not gain write access or code execution; the impact is limited to confidentiality breach of draft slider data.

Mitigation

The vulnerability is fixed in version 2.8.2 of the plugin, as indicated by the changeset [1]. Users are strongly advised to update to the latest version immediately. No workarounds are available for older versions. The plugin is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.