Junglewise Threat Intelligence

CVE-2026-7636: Soliloquy Slider for WordPress sensitive information exposure in map_meta_cap

CVE-2026-7636 · Severity: medium · CVSS 4.3 · Published 2026-05-22

Executive brief

A vulnerability in the Soliloquy image slider plugin for WordPress allows users with basic account access to view private information. This includes draft slider content, unpublished image links, and internal configuration settings created by site administrators. This could lead to the exposure of sensitive media or marketing materials before they are intended for public release.

Technical details

The Slider by Soliloquy plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to and including 2.8.1. The flaw exists within the map_meta_cap function, which fails to properly restrict access to slider metadata. An authenticated attacker with subscriber-level permissions or higher can exploit this to retrieve draft slider configurations, unpublished media URLs, and captions authored by higher-privileged users like administrators or editors. This is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). A patch has been released in the plugin's trunk/latest versions.

Affected products

  • Soliloquy Slider by Soliloquy – Responsive Image Slider for WordPress Up to, and including, 2.8.1

Timeline

  • 2026-05-22: disclosed: CVE published by Wordfence/NVD

References