{
 "id": "WPSEC-2026-1638",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1638/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1638/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1638/index.md",
 "title": "Ghost Kit – Page Builder Blocks, Motion Effects & Extensions <= 3.7.2 - Unauthenticated Information Exposure via Attachment Image REST Endpoint",
 "description": "The Ghost Kit plugin for WordPress is vulnerable to Information Exposure via the get_attachment_image REST API route in all versions up to, and including, 3.7.2, due to the route's permission callback always returning true and the callback not checking whether the requester may read the requested attachment. This makes it possible for unauthenticated attackers to retrieve the file URL, dimensions and alt text of arbitrary image attachments by ID, including images attached to draft or private posts.",
 "plugin": {
  "slug": "ghostkit",
  "name": "Ghost Kit – Page Builder Blocks, Motion Effects & Extensions",
  "full_name": "Block Animations, Motion & Scroll Effects – Ghost Kit",
  "wordpress_org": "https://wordpress.org/plugins/ghostkit/",
  "advisories_url": "https://wpsec.com/vuln/plugin/ghostkit/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/ghostkit"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "3.8.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 3.8.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "3.8.0",
 "remediation": "Update to 3.8.0 or later.",
 "fix_released": "2026-10-24T08:20:18+00:00",
 "published": "2026-10-25T08:43:04+00:00",
 "updated": "2026-10-24T13:32:38.139335+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1638/",
  "https://plugins.svn.wordpress.org/ghostkit/tags/3.8.0/",
  "https://wordpress.org/plugins/ghostkit/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/ghostkit",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-25"
 }
}