Vulnerabilities / Expandable Paywall / WPSEC-2026-1542
Expandable Paywall <= 2.3.1 - Unauthenticated Sensitive Information Exposure via REST API
Medium 5.3
CWE-200Fixed in 2.3.2
- ID
- WPSEC-2026-1542
- Plugin
- Expandable Paywall (expandable-paywall)
- Affected
- all versions before 2.3.2
- Remediation
- Update to 2.3.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-23
- Attack surface
- Expandable Paywall on WPSec AttackSurface
- Fix released
- Published
Description
The Expandable Paywall plugin for WordPress is vulnerable to Sensitive Information Exposure via the WordPress REST API in all versions up to, and including, 2.3.1. This is due to the basic paywall being enforced only on the rendered singular article page (template_redirect), while REST API post responses were returned unmodified. This makes it possible for unauthenticated attackers to read the full content of paywalled articles by requesting endpoints such as /wp-json/wp/v2/posts/<id>, bypassing the paywall.
References
- https://wpsec.com/vuln/WPSEC-2026-1542/
- https://plugins.svn.wordpress.org/expandable-paywall/tags/2.3.2/
- https://wordpress.org/plugins/expandable-paywall/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS