CVE-2026-86786: 
WordPress vulnerability analysis and mitigation

CVE-2026-86786 is an unauthenticated sensitive data disclosure vulnerability in the Slider Pro WordPress plugin (versions through 1.0.0). The flaw allows unauthenticated users to retrieve the title, excerpt, and permalink of non-public posts — including drafts, pending, scheduled, private, and trashed posts — as well as post revisions and media metadata. It was publicly disclosed on October 3, 2026, and was originally discovered by researcher Seongwon Lee. The vulnerability carries a CVSS v3.1 base score of 5.3 (Medium) (WPScan).

The root cause is a missing capability and authorization check on one of the plugin's AJAX actions (sliderpro_multiple_images), classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). Because WordPress AJAX endpoints are accessible without authentication by default unless explicitly restricted, any unauthenticated HTTP request to this action can trigger the data disclosure. No special privileges, user interaction, or complex conditions are required for exploitation, making it trivially automatable (WPScan).

Successful exploitation exposes confidential post content metadata — including titles, excerpts, and permalinks — for posts that site administrators intended to keep private, such as drafts, scheduled content, and private posts. While this does not result in full content disclosure or system compromise, it can leak sensitive editorial, business, or personal information before intended publication. Media metadata exposure may also reveal internal file naming conventions or upload paths useful for further reconnaissance (WPScan).

No public proof-of-concept exploit code has been released as of the disclosure date; WPScan indicated the PoC would be published on October 17, 2026, to allow time for users to update. There is no evidence of in-the-wild exploitation, no known threat actor attribution, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.00145, reflecting a low probability of near-term exploitation (WPScan).

1. Reconnaissance: Identify WordPress sites running the Slider Pro plugin (version ≤ 1.0.0) using tools like WPScan, Shodan, or by inspecting page source for plugin references (e.g., /wp-content/plugins/slider-pro-wp/).
2. Identify the vulnerable AJAX endpoint: The vulnerable action is sliderpro_multiple_images, accessible via the standard WordPress AJAX handler at /wp-admin/admin-ajax.php.
3. Craft the unauthenticated request: Send an HTTP POST request to https://target.com/wp-admin/admin-ajax.php with the body parameter action=sliderpro_multiple_images and any required additional parameters (full parameter details to be released with PoC on October 17, 2026).
4. Retrieve disclosed data: Parse the JSON response to extract titles, excerpts, and permalinks of non-public posts, including drafts, private posts, scheduled posts, and media metadata (WPScan).

• Network: Unusual or repeated unauthenticated POST requests to /wp-admin/admin-ajax.php with action=sliderpro_multiple_images in the request body, originating from unexpected IP addresses or automated scanning tools.
• Logs: Web server access logs showing high-frequency requests to admin-ajax.php without a valid session cookie or nonce, particularly from a single IP or user-agent string associated with scanning tools (e.g., WPScan, curl).
• Logs: WordPress debug logs or server logs showing AJAX action sliderpro_multiple_images being invoked by unauthenticated users (nopriv context).

As of the disclosure date, there is no known fix available for the Slider Pro plugin (≤ 1.0.0). Site administrators should consider deactivating and removing the plugin until a patched version is released. As a workaround, web application firewall (WAF) rules can be configured to block unauthenticated POST requests to admin-ajax.php with the action=sliderpro_multiple_images parameter. Monitor the WPScan vulnerability database and the plugin's repository for patch availability (WPScan).

Wordfence referenced this vulnerability in their weekly WordPress vulnerability report covering the period of September 28 – October 4, 2026, as part of broader coverage of WordPress plugin security issues. No significant independent researcher commentary or major media coverage has been identified beyond standard vulnerability database aggregation.