Slider by Soliloquy WordPress Plugin Sensitive Information Exposure Vulnerability

A vulnerability allowing sensitive information exposure has been identified in the Slider by Soliloquy WordPress plugin, in all versions through 2.8.1. This vulnerability arises from the 'map_meta_cap' feature, which can be exploited by authenticated users with subscriber-level access or higher. The issue allows these users to access draft slider metadata, including unpublished media URLs, captions, and slider configurations created by administrators or editors.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive slider metadata, including unpublished media URLs and captions, potentially allowing for further exploitation or misuse of this information.

Reproduction

To reproduce this vulnerability, an authenticated user with subscriber-level access or higher can send a request to the WordPress REST API endpoint for the Soliloquy slider post type. The 'map_meta_cap' filter will allow access to draft sliders, from which unpublished media URLs, captions, and slider configurations can be extracted.

Remediation

Users are advised to update the Slider by Soliloquy WordPress plugin to version 2.8.2 or a newer patched version.