Slider Pro CVE-2026-86786

No special configuration or authentication is required: the flaw is one specific AJAX action of the Slider Pro plugin that performs no capability or authorisation check, so any unauthenticated remote user can invoke it against a default installation of Slider Pro (versions 0 through 1.0.0) on a WordPress site. The only prerequisites are that the Slider Pro plugin (≤1.0.0) is installed and active and that the site is network-reachable. Limiting factor on real-world impact: the disclosure is restricted to metadata - titles, excerpts, permalinks and media metadata of non-public posts (drafts, pending, scheduled, private, trashed), plus revisions - not the full post bodies, so the leaked data is of limited sensitivity in most deployments.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, base 5.3 Medium) describes a remotely reachable, low-complexity, unauthenticated information-disclosure flaw with only limited confidentiality impact and no integrity or availability effect - a profile consistent with CWE-200. Multiple signals agree that this is a low-urgency issue rather than a high-priority one: SSVC marks Exploitation as 'none' (no observed exploitation) even though Automatable is 'yes' and Technical Impact is 'partial', and the vulnerability is NOT on the CISA KEV list. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be factored in and should be verified separately. The one signal that raises attention is that publicly available exploit code exists (via WPScan), and the flaw is automatable, so opportunistic mass-scanning of WordPress sites is plausible; however, the payoff is modest (leaked titles, excerpts, permalinks and media metadata of non-public posts - not full content, credentials, or write access). Net: a genuine but low-severity confidentiality leak worth patching, not an emergency. The signals are internally consistent - no contradiction between the network vector and the described unauthenticated AJAX access.

An unauthenticated attacker sends a crafted request to the plugin's unprotected AJAX action on a target WordPress site and receives back the titles, excerpts and permalinks of posts that should be hidden - drafts, pending, scheduled, private, trashed posts, revisions, and media metadata. Because public exploit code exists (WPScan) and the issue is automatable, this can be scripted across many sites to harvest unpublished content metadata. The low CVSS complexity (AC:L) and lack of required authentication (PR:N) or user interaction (UI:N) make the request trivial to issue.