{
 "id": "WPSEC-2026-2039",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2039/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2039/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2039/index.md",
 "title": "WP Tabs – Responsive Tabs Plugin for WordPress <= 3.1.7 - Authenticated (Contributor+) Sensitive Information Exposure via 'wptabs' Shortcode",
 "description": "The Smart Tabs plugin for WordPress is vulnerable to Sensitive Information Exposure via the 'wptabs' shortcode in all versions up to, and including, 3.1.7. This is due to the shortcode rendering tab groups regardless of their status, including draft, pending, private, scheduled and password-protected tab groups. This makes it possible for authenticated attackers with contributor-level access and above to embed the shortcode and view the contents of tab groups that have not been published.",
 "plugin": {
  "slug": "wp-expand-tabs-free",
  "name": "WP Tabs – Responsive Tabs Plugin for WordPress",
  "full_name": "Custom Product Tabs for WooCommerce & WordPress Tabs Builder – Smart Tabs",
  "wordpress_org": "https://wordpress.org/plugins/wp-expand-tabs-free/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wp-expand-tabs-free/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wp-expand-tabs-free"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "3.1.8",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 3.1.8"
  ]
 },
 "introduced_in": null,
 "fixed_in": "3.1.8",
 "remediation": "Update to 3.1.8 or later.",
 "fix_released": "2026-10-29T10:14:05+00:00",
 "published": "2026-10-30T10:50:10+00:00",
 "updated": "2026-10-29T17:37:59.805510+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2039/",
  "https://plugins.svn.wordpress.org/wp-expand-tabs-free/tags/3.1.8/",
  "https://wordpress.org/plugins/wp-expand-tabs-free/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wp-expand-tabs-free",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-30"
 }
}