Vulnerabilities / Ghost Kit – Page Builder Blocks, Motion Effects & Extensions / WPSEC-2026-1638
Ghost Kit – Page Builder Blocks, Motion Effects & Extensions <= 3.7.2 - Unauthenticated Information Exposure via Attachment Image REST Endpoint
Medium 5.3
CWE-200Fixed in 3.8.0
- ID
- WPSEC-2026-1638
- Plugin
- Block Animations, Motion & Scroll Effects – Ghost Kit (ghostkit)
- Affected
- all versions before 3.8.0
- Remediation
- Update to 3.8.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-25
- Attack surface
- Ghost Kit – Page Builder Blocks, Motion Effects & Extensions on WPSec AttackSurface
- Fix released
- Published
Description
The Ghost Kit plugin for WordPress is vulnerable to Information Exposure via the get_attachment_image REST API route in all versions up to, and including, 3.7.2, due to the route's permission callback always returning true and the callback not checking whether the requester may read the requested attachment. This makes it possible for unauthenticated attackers to retrieve the file URL, dimensions and alt text of arbitrary image attachments by ID, including images attached to draft or private posts.
References
- https://wpsec.com/vuln/WPSEC-2026-1638/
- https://plugins.svn.wordpress.org/ghostkit/tags/3.8.0/
- https://wordpress.org/plugins/ghostkit/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS