Prime Slider – Addons For Elementor <= 4.6.1 - Authenticated (Contributor+) Sensitive Information Exposure via Blog Widget Zinest Skin Featured Posts
- ID
- WPSEC-2026-0031
- Plugin
- Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons (bdthemes-prime-slider-lite)
- Affected
- from 3.5.0 before 4.6.2
- Remediation
- Update to 4.6.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-22
- Attack surface
- Prime Slider – Addons For Elementor on WPSec AttackSurface
- Fix released
- Published
Description
The Prime Slider plugin for WordPress is vulnerable to Sensitive Information Exposure via the Blog widget's Zinest skin featured posts strip in versions 3.5.0 up to, and including, 4.6.1. The strip runs a WP_Query over any post type with no post status restriction, so when the Elementor editor renders the widget through admin-ajax the query also returns other authors' draft, pending and scheduled posts, including posts picked by ID. This makes it possible for authenticated attackers with Contributor-level access and above who can use the Elementor editor to read the titles and excerpt text of other authors' unpublished posts, up to their full content when the excerpt length is set to 0.
References
- https://wpsec.com/vuln/WPSEC-2026-0031/
- https://plugins.svn.wordpress.org/bdthemes-prime-slider-lite/tags/4.6.2/
- https://wordpress.org/plugins/bdthemes-prime-slider-lite/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS