WP Tabs – Responsive Tabs Plugin for WordPress <= 3.1.7 - Authenticated (Contributor+) Sensitive Information Exposure via 'wptabs' Shortcode

ID

WPSEC-2026-2039

Plugin

Custom Product Tabs for WooCommerce & WordPress Tabs Builder – Smart Tabs (wp-expand-tabs-free)

Affected

all versions before 3.1.8

Remediation

Update to 3.1.8 or later.

CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness

CWE-200

Usage

Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-30

Attack surface

WP Tabs – Responsive Tabs Plugin for WordPress on WPSec AttackSurface

Fix released

2026-10-29

Published

2026-10-30

Description

The Smart Tabs plugin for WordPress is vulnerable to Sensitive Information Exposure via the 'wptabs' shortcode in all versions up to, and including, 3.1.7. This is due to the shortcode rendering tab groups regardless of their status, including draft, pending, private, scheduled and password-protected tab groups. This makes it possible for authenticated attackers with contributor-level access and above to embed the shortcode and view the contents of tab groups that have not been published.

References

• https://wpsec.com/vuln/WPSEC-2026-2039/
• https://plugins.svn.wordpress.org/wp-expand-tabs-free/tags/3.1.8/
• https://wordpress.org/plugins/wp-expand-tabs-free/

Published by WPSec. Provided as is, without warranty. Corrections: contact us.

This advisory as JSON or Markdown · All advisories: JSON, RSS