# Expandable Paywall <= 2.3.1 - Unauthenticated Sensitive Information Exposure via REST API

- **ID:** WPSEC-2026-1542
- **Plugin:** Expandable Paywall (`expandable-paywall`), https://wordpress.org/plugins/expandable-paywall/
- **Affected versions:** all versions before 2.3.2
- **Fixed in:** 2.3.2 (Update to 2.3.2 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-23)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/expandable-paywall
- **Fix released:** 2026-10-22
- **Published:** 2026-10-23
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1542/

## Description

The Expandable Paywall plugin for WordPress is vulnerable to Sensitive Information Exposure via the WordPress REST API in all versions up to, and including, 2.3.1. This is due to the basic paywall being enforced only on the rendered singular article page (template_redirect), while REST API post responses were returned unmodified. This makes it possible for unauthenticated attackers to read the full content of paywalled articles by requesting endpoints such as /wp-json/wp/v2/posts/<id>, bypassing the paywall.

## References

- https://wpsec.com/vuln/WPSEC-2026-1542/
- https://plugins.svn.wordpress.org/expandable-paywall/tags/2.3.2/
- https://wordpress.org/plugins/expandable-paywall/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1542/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.