# WP Carousel Free <= 4.0.1 - Unauthenticated Sensitive Information Exposure via Block AJAX Pagination

- **ID:** WPSEC-2026-1753
- **Plugin:** AI-Powered Carousel, Slider, Video & Photo Gallery Blocks by WP Carousel (`wp-carousel-free`), https://wordpress.org/plugins/wp-carousel-free/
- **Affected versions:** from 3.0.0 before 5.0.0
- **Fixed in:** 5.0.0 (Update to 5.0.0 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-27)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wp-carousel-free
- **Fix released:** 2026-10-26
- **Published:** 2026-10-27
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1753/

## Description

The AI-Powered Carousel, Slider, Video & Photo Gallery Blocks by WP Carousel plugin for WordPress is vulnerable to Sensitive Information Exposure via the block AJAX pagination REST route (wp-carousel-pro/v1/ajax-pagination) and the carousel block image, video, post and product sources in all versions from 3.0.0 up to, and including, 4.0.1. This is due to the image and video sources loading any post ID supplied in the block item list with get_post(), without checking that it is an attachment or that the visitor may read it, and the post and product sources outputting the full content of password-protected posts and products. The route only requires the REST nonce that every page with a carousel block prints for visitors. This makes it possible for unauthenticated attackers to read the titles, excerpts and content of private, draft and password-protected posts, pages and attachments.

## References

- https://wpsec.com/vuln/WPSEC-2026-1753/
- https://plugins.svn.wordpress.org/wp-carousel-free/tags/5.0.0/
- https://wordpress.org/plugins/wp-carousel-free/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1753/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.