{
 "id": "WPSEC-2026-2542",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2542/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2542/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2542/index.md",
 "title": "VK All in One Expansion Unit <= 9.123.1 - Unauthenticated Sensitive Information Exposure via Child Page List",
 "description": "The VK All in One Expansion Unit plugin for WordPress is vulnerable to Sensitive Information Exposure via the Child Page List feature in all versions up to, and including, 9.123.1. This is due to the child page excerpt helper not checking whether a child page is password-protected before outputting its excerpt or the beginning of its content. This makes it possible for unauthenticated attackers to read the excerpt or opening content of password-protected pages without knowing the password.",
 "plugin": {
  "slug": "vk-all-in-one-expansion-unit",
  "name": "VK All in One Expansion Unit",
  "full_name": "VK All in One Expansion Unit",
  "wordpress_org": "https://wordpress.org/plugins/vk-all-in-one-expansion-unit/",
  "advisories_url": "https://wpsec.com/vuln/plugin/vk-all-in-one-expansion-unit/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/vk-all-in-one-expansion-unit"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "9.124.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 9.124.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "9.124.0",
 "remediation": "Update to 9.124.0 or later.",
 "fix_released": "2026-11-04T07:18:22+00:00",
 "published": "2026-11-05T07:45:42+00:00",
 "updated": "2026-11-04T13:57:07.260216+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2542/",
  "https://plugins.svn.wordpress.org/vk-all-in-one-expansion-unit/tags/9.124.0/",
  "https://wordpress.org/plugins/vk-all-in-one-expansion-unit/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/vk-all-in-one-expansion-unit",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-05"
 }
}