# Display Post Types <= 3.4.4 - Authenticated (Contributor+) Sensitive Information Exposure via Non-Public Post Types

- **ID:** WPSEC-2026-1237
- **Plugin:** Display Post Types – Post Grid, post list and post sliders (`display-post-types`), https://wordpress.org/plugins/display-post-types/
- **Affected versions:** all versions before 3.4.5
- **Fixed in:** 3.4.5 (Update to 3.4.5 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-18)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/display-post-types
- **Fix released:** 2026-10-18
- **Published:** 2026-10-19
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1237/

## Description

The Display Post Types plugin for WordPress is vulnerable to Sensitive Information Exposure via the 'post_type' setting of the [dpt] shortcode, block, and widget in all versions up to, and including, 3.4.4. This is because the shared query builder accepts any post type without checking that it is publicly viewable. This makes it possible for authenticated attackers, with Contributor-level access and above, to show and read published entries of non-public, internal post types, such as data stored by other plugins, that are not meant to be visible on the front end.

## References

- https://wpsec.com/vuln/WPSEC-2026-1237/
- https://plugins.svn.wordpress.org/display-post-types/tags/3.4.5/
- https://wordpress.org/plugins/display-post-types/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1237/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.