CVE-2026-7636: Soliloquy Slider Information Disclosure

CVE-2026-7636 Overview

CVE-2026-7636 is a sensitive information exposure vulnerability in the Slider by Soliloquy – Responsive Image Slider for WordPress plugin. All versions up to and including 2.8.1 are affected. The flaw resides in the map_meta_cap implementation within includes/global/posttype.php, which fails to properly restrict access to draft slider content. Authenticated users with subscriber-level access or higher can extract draft slider metadata, including unpublished media URLs, captions, and slider configuration authored by administrators or editors. The issue is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Any authenticated WordPress user, including low-privilege subscribers, can read unpublished slider data intended only for administrators and editors.

Affected Products

Slider by Soliloquy – Responsive Image Slider for WordPress (soliloquy-lite) versions through 2.8.1
WordPress sites running the Soliloquy Lite plugin with subscriber registration enabled
Sites granting subscriber-level or higher accounts to untrusted users

Discovery Timeline

2026-05-22 - CVE-2026-7636 published to NVD
2026-05-22 - Last updated in NVD database

Technical Details for CVE-2026-7636

Vulnerability Analysis

The vulnerability stems from improper capability mapping in the Soliloquy Lite plugin's custom post type registration. The plugin defines a custom post type for sliders and uses the WordPress map_meta_cap filter to translate meta capabilities into primitive capabilities. The implementation in includes/global/posttype.php (lines 90, 125, and 177) does not adequately restrict access to draft posts. As a result, capability checks resolve in a way that permits low-privilege authenticated users to query and read draft slider entries.

Draft sliders typically contain unreleased marketing assets, embargoed campaign imagery, captions referencing unannounced products, and configuration data describing future content. Exposure of this metadata can leak business-sensitive material before its intended publication date.

Root Cause

The root cause is incorrect logic in the map_meta_cap callback for the slider post type. The function returns primitive capabilities that low-privilege roles already possess, rather than enforcing edit and read checks scoped to the slider's author and post status. WordPress treats this as authorization to access the underlying draft content via standard REST and admin-ajax endpoints.

Attack Vector

Exploitation requires only a valid authenticated session with at least subscriber privileges. An attacker logs in, then issues requests to WordPress endpoints that retrieve slider posts in draft status. Because the capability map resolves favorably for the attacker, the response includes draft slider metadata that should remain restricted to editors and administrators. No user interaction from a privileged account is required.

For technical detail on the vulnerable code paths, see the Soliloquy Lite source at posttype.php line 90, the capability check at line 125, and the related logic at line 177. The corrective changeset 3538404 tightens these checks.

Detection Methods for CVE-2026-7636

Indicators of Compromise

Authenticated requests from subscriber-level accounts to endpoints handling the soliloquy custom post type, particularly with post_status=draft or similar parameters
Unexpected admin-ajax.php or REST API calls referencing slider post IDs from non-editor accounts
Web server access logs showing low-privilege session cookies retrieving slider metadata payloads larger than typical front-end usage

Detection Strategies

Review WordPress audit logs for subscribers accessing slider administration routes or querying draft post types
Correlate authentication events with REST API access patterns to surface accounts enumerating slider content
Inspect HTTP responses delivered to subscriber sessions for fields such as draft media URLs, captions, and slider configuration JSON

Monitoring Recommendations

Enable verbose logging on the Soliloquy plugin and WordPress REST API to capture caller role, post ID, and post status
Alert on any single authenticated session retrieving multiple slider records in a short interval
Monitor new subscriber account creation followed by rapid access to plugin endpoints, which is a common pattern for this class of issue

How to Mitigate CVE-2026-7636

Immediate Actions Required

Update Slider by Soliloquy to the version released in changeset 3538404, which is later than 2.8.1
Audit existing WordPress user accounts and remove dormant or unknown subscriber accounts
Review draft slider content for sensitive material and assume previously exposed drafts may have been read

Patch Information

The vendor addressed the issue by correcting the map_meta_cap logic in includes/global/posttype.php. The fix is published in the plugin trunk via changeset 3538404. Additional context is available from the Wordfence vulnerability intelligence entry.

Workarounds

Disable open user registration in WordPress general settings to prevent attackers from obtaining subscriber accounts
Deactivate the Soliloquy Lite plugin until the patched version is deployed if subscriber accounts cannot be restricted
Restrict access to wp-admin/admin-ajax.php and the WordPress REST API at the web application firewall layer for unauthenticated and low-privilege sessions

bash

# Verify installed Soliloquy Lite version and update via WP-CLI
wp plugin get soliloquy-lite --field=version
wp plugin update soliloquy-lite

# Disable open registration as a defense-in-depth measure
wp option update users_can_register 0