The vulnerability in the B Slider Gutenberg Slider Block for WordPress allows authenticated users with subscriber-level access or higher to retrieve sensitive data such as the list of active plugins. The flaw is triggered by the plugin’s use of the get_active_plugins function, which inadvertently exposes information that should remain confidential. This exposure enables attackers to gain insight into the site’s configuration and potentially aid further attacks. The weakness is classified as CWE‑200 Sensitive Data Exposure.

All installations of the B Slider plugin version 2.0.0 or earlier installed on WordPress sites are affected. The plugin is developed by bplugins and provides responsive slider functionality for images, posts, products, and videos.

The CVSS score of 4.3 indicates moderate severity, and the EPSS score of less than 1% shows a very low likelihood of attack at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to be authenticated as a subscriber or higher; no remote code execution or privilege escalation is possible beyond data disclosure. Therefore, the main risk is the potential compromise of sensitive site information if the attacker can log in.