CVE-2026-86786

Name of the Vulnerable Software and Affected Versions Slider Pro versions prior to 1.0.1

Description The Slider Pro WordPress plugin fails to perform capability or authorization checks on an AJAX action. This allows unauthenticated users to retrieve sensitive information from non-public posts, including drafts, pending, scheduled, private, and trashed posts, as well as post revisions and media metadata. The issue is associated with the sliderpro multiple images action.

Recommendations Update Slider Pro to a version newer than 1.0.0. As a temporary mitigation, restrict access to the sliderpro multiple images AJAX action.