Prime Slider – Addons For Elementor <= 4.6.1 - Authenticated (Contributor+) Sensitive Information Exposure via Query Control Dynamic Select Search
- ID
- WPSEC-2026-0032
- Plugin
- Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons (bdthemes-prime-slider-lite)
- Affected
- from 2.0.0 before 4.6.2
- Remediation
- Update to 4.6.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-22
- Attack surface
- Prime Slider – Addons For Elementor on WPSec AttackSurface
- Fix released
- Published
Description
The Prime Slider plugin for WordPress is vulnerable to Sensitive Information Exposure via the query control dynamic select AJAX search (prime_slider_dynamic_select_input_data) in versions 2.0.0 up to, and including, 4.6.1. The post search runs in an admin-ajax context, where WP_Query also returns draft, pending and scheduled posts, and it does not check whether the current user can read each returned post. The user search lists every user on the site and does not restrict users who lack the list_users capability. This makes it possible for authenticated attackers with Contributor-level access and above who can open the Elementor editor to list, look up by ID and content-search the titles of other authors' unpublished (draft, pending and scheduled) posts, to list all users including subscribers who have never published anything, and to discover users' e-mail addresses and website URLs through substring searches.
References
- https://wpsec.com/vuln/WPSEC-2026-0032/
- https://plugins.svn.wordpress.org/bdthemes-prime-slider-lite/tags/4.6.2/
- https://wordpress.org/plugins/bdthemes-prime-slider-lite/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS