The Slider by Soliloquy – Responsive Image Slider for WordPress plugin is vulnerable to a Sensitive Information Disclosure flaw in all versions up to 2.8.1. The flaw arises from the map_meta_cap function which allows authenticated users with subscriber-level access or higher to read draft slider metadata such as unpublished media URLs, captions, and slider configuration created by administrators or editors. The weakness is classified as CWE-200, permitting attackers to obtain confidential information about slider content without any privilege escalation.

WordPress sites that use the Slider by Soliloquy plugin in any version from the earliest release up to and including 2.8.1. The vulnerability impacts users with subscriber or higher roles on those installations.

The CVSS score of 4.3 indicates a moderate risk level, and the vulnerability is not listed in the CISA KEV catalog nor is an EPSS score available. The attack vector is authenticated, requiring a subscriber or higher user to access the REST API endpoint that leaks slider metadata. If the REST API is exposed to the web, any authenticated user can query the endpoint and retrieve sensitive draft information, potentially compromising confidentiality and revealing draft media assets and configuration details.