CVE-2026-86786

Published 6 October 2026 · tracked since 7 October 2026

Description

The Slider Pro WordPress plugin through 1.0.0 does not perform any capability or authorisation check on one of its AJAX actions, allowing unauthenticated users to retrieve the title, excerpt and permalink of non-public posts, including drafts, pending, scheduled, private and trashed posts, as well a

References

• NVD — National Vulnerability Database
• CVE.org record (MITRE)
• CISA Known Exploited Vulnerabilities catalog

Latest tracked vulnerabilities

• CVE-2026-4889
• CVE-2026-41559 HIGH 7.5
• CVE-2026-39797 CRITICAL 9.8
• CVE-2026-39775 HIGH 8.8
• CVE-2026-39752 HIGH 7.7
• CVE-2026-39728 HIGH 7.2
• CVE-2026-32579 CRITICAL 10
• CVE-2026-105808 LOW 3.5
• CVE-2026-105809 MEDIUM 4.3
• CVE-2026-105059 MEDIUM 6.5

→ Open the live CVE board · all tools