The Slider by Soliloquy plugin for WordPress contains a sensitive information exposure vulnerability (CWE-200) affecting all versions up to 2.8.1. Authenticated attackers with subscriber-level privileges or above can exploit improper access control on the map_meta_cap capability to retrieve draft slider metadata. This includes unpublished media URLs, captions, and slider configuration data created by administrators or editors. The CVSS 3.1 base score is 4.3 (medium severity), reflecting network attack vector, low attack complexity, and limited confidentiality impact. No vendor advisory or patch information is currently available.

An attacker with subscriber-level access or higher can access unpublished slider metadata, potentially revealing sensitive media URLs and configuration details not intended for their role. This exposure compromises confidentiality but does not affect integrity or availability of the system. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict subscriber-level access to trusted users only and monitor for any suspicious activity related to slider metadata access. Avoid granting unnecessary privileges to low-level authenticated users.