Vulnerabilities / Post Carousel / WPSEC-2026-2188
Post Carousel <= 4.0.9 - Unauthenticated Non-Public Post Type Information Exposure via sp_handle_post_id AJAX Action
Medium 5.3
CWE-200Fixed in 4.0.10
- ID
- WPSEC-2026-2188
- Plugin
- Smart Post – Post Grid, Post Carousel, Post Slider Gutenberg Blocks for Blog & News (post-carousel)
- Affected
- from 4.0.0 before 4.0.10
- Remediation
- Update to 4.0.10 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-03
- Attack surface
- Post Carousel on WPSec AttackSurface
- Fix released
- Published
Description
The Smart Post plugin for WordPress is vulnerable to Sensitive Information Exposure via the sp_handle_post_id AJAX action in all versions from 4.0.0 up to, and including, 4.0.9, due to the handler returning the title, rendered content and other data of any published post by ID without checking that its post type is public. This makes it possible for unauthenticated attackers to read data from published posts of non-public post types, such as WooCommerce coupon codes.
References
- https://wpsec.com/vuln/WPSEC-2026-2188/
- https://plugins.svn.wordpress.org/post-carousel/tags/4.0.10/
- https://wordpress.org/plugins/post-carousel/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS