# Ghost Kit – Page Builder Blocks, Motion Effects & Extensions <= 3.7.2 - Unauthenticated Information Exposure via Attachment Image REST Endpoint

- **ID:** WPSEC-2026-1638
- **Plugin:** Block Animations, Motion & Scroll Effects – Ghost Kit (`ghostkit`), https://wordpress.org/plugins/ghostkit/
- **Affected versions:** all versions before 3.8.0
- **Fixed in:** 3.8.0 (Update to 3.8.0 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-25)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/ghostkit
- **Fix released:** 2026-10-24
- **Published:** 2026-10-25
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1638/

## Description

The Ghost Kit plugin for WordPress is vulnerable to Information Exposure via the get_attachment_image REST API route in all versions up to, and including, 3.7.2, due to the route's permission callback always returning true and the callback not checking whether the requester may read the requested attachment. This makes it possible for unauthenticated attackers to retrieve the file URL, dimensions and alt text of arbitrary image attachments by ID, including images attached to draft or private posts.

## References

- https://wpsec.com/vuln/WPSEC-2026-1638/
- https://plugins.svn.wordpress.org/ghostkit/tags/3.8.0/
- https://wordpress.org/plugins/ghostkit/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1638/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.