CVE-2026-86786: CWE-200 Information Exposure in Slider Pro

CVE-2026-86786 is an information exposure vulnerability (CWE-200) in the Slider Pro WordPress plugin versions up to and including 1.0.0. The plugin does not enforce capability or authorization checks on one of its AJAX actions. This flaw allows unauthenticated users to retrieve sensitive metadata and content from non-public posts and media, including drafts, pending, scheduled, private, trashed posts, post revisions, and media metadata, potentially leaking confidential information.

Unauthenticated attackers can access sensitive information about non-public WordPress content that should normally be restricted. This includes titles, excerpts, permalinks of unpublished or private posts and media metadata. While this does not allow direct modification or deletion, the exposure of such information could aid in further targeted attacks or information gathering.

No official patch or fix is currently documented. Users should monitor the vendor's advisory for updates. Until a fix is available, restricting access to AJAX endpoints via web application firewalls or custom code to enforce authorization checks may reduce exposure. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.