CVE-2026-86786
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
The Slider Pro WordPress plugin through 1.0.0 does not perform any capability or authorisation check on one of its AJAX actions, allowing unauthenticated users to retrieve the title, excerpt and permalink of non-public posts, including drafts, pending, scheduled, private and trashed posts, as well as post revisions and media metadata.
Risk Assessment
The risk includes disclosure of confidential content and metadata, which may lead to privacy breaches and information leakage.
Recommendation
It is recommended to update the Slider Pro plugin to a patched version and implement capability checks for AJAX actions.
Other vulnerabilities in Slider Pro
Original NVD description (English source)
The Slider Pro WordPress plugin through 1.0.0 does not perform any capability or authorisation check on one of its AJAX actions, allowing unauthenticated users to retrieve the title, excerpt and permalink of non-public posts, including drafts, pending, scheduled, private and trashed posts, as well as post revisions and media metadata.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS