WP Carousel Free <= 4.0.1 - Unauthenticated Sensitive Information Exposure via Block AJAX Pagination
- ID
- WPSEC-2026-1753
- Plugin
- AI-Powered Carousel, Slider, Video & Photo Gallery Blocks by WP Carousel (wp-carousel-free)
- Affected
- from 3.0.0 before 5.0.0
- Remediation
- Update to 5.0.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-27
- Attack surface
- WP Carousel Free on WPSec AttackSurface
- Fix released
- Published
Description
The AI-Powered Carousel, Slider, Video & Photo Gallery Blocks by WP Carousel plugin for WordPress is vulnerable to Sensitive Information Exposure via the block AJAX pagination REST route (wp-carousel-pro/v1/ajax-pagination) and the carousel block image, video, post and product sources in all versions from 3.0.0 up to, and including, 4.0.1. This is due to the image and video sources loading any post ID supplied in the block item list with get_post(), without checking that it is an attachment or that the visitor may read it, and the post and product sources outputting the full content of password-protected posts and products. The route only requires the REST nonce that every page with a carousel block prints for visitors. This makes it possible for unauthenticated attackers to read the titles, excerpts and content of private, draft and password-protected posts, pages and attachments.
References
- https://wpsec.com/vuln/WPSEC-2026-1753/
- https://plugins.svn.wordpress.org/wp-carousel-free/tags/5.0.0/
- https://wordpress.org/plugins/wp-carousel-free/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS