# WP Tabs – Responsive Tabs Plugin for WordPress <= 3.1.7 - Authenticated (Contributor+) Sensitive Information Exposure via 'wptabs' Shortcode

- **ID:** WPSEC-2026-2039
- **Plugin:** Custom Product Tabs for WooCommerce & WordPress Tabs Builder – Smart Tabs (`wp-expand-tabs-free`), https://wordpress.org/plugins/wp-expand-tabs-free/
- **Affected versions:** all versions before 3.1.8
- **Fixed in:** 3.1.8 (Update to 3.1.8 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-30)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wp-expand-tabs-free
- **Fix released:** 2026-10-29
- **Published:** 2026-10-30
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2039/

## Description

The Smart Tabs plugin for WordPress is vulnerable to Sensitive Information Exposure via the 'wptabs' shortcode in all versions up to, and including, 3.1.7. This is due to the shortcode rendering tab groups regardless of their status, including draft, pending, private, scheduled and password-protected tab groups. This makes it possible for authenticated attackers with contributor-level access and above to embed the shortcode and view the contents of tab groups that have not been published.

## References

- https://wpsec.com/vuln/WPSEC-2026-2039/
- https://plugins.svn.wordpress.org/wp-expand-tabs-free/tags/3.1.8/
- https://wordpress.org/plugins/wp-expand-tabs-free/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2039/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.