# VK All in One Expansion Unit <= 9.123.1 - Unauthenticated Sensitive Information Exposure via Child Page List

- **ID:** WPSEC-2026-2542
- **Plugin:** VK All in One Expansion Unit (`vk-all-in-one-expansion-unit`), https://wordpress.org/plugins/vk-all-in-one-expansion-unit/
- **Affected versions:** all versions before 9.124.0
- **Fixed in:** 9.124.0 (Update to 9.124.0 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-05)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/vk-all-in-one-expansion-unit
- **Fix released:** 2026-11-04
- **Published:** 2026-11-05
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2542/

## Description

The VK All in One Expansion Unit plugin for WordPress is vulnerable to Sensitive Information Exposure via the Child Page List feature in all versions up to, and including, 9.123.1. This is due to the child page excerpt helper not checking whether a child page is password-protected before outputting its excerpt or the beginning of its content. This makes it possible for unauthenticated attackers to read the excerpt or opening content of password-protected pages without knowing the password.

## References

- https://wpsec.com/vuln/WPSEC-2026-2542/
- https://plugins.svn.wordpress.org/vk-all-in-one-expansion-unit/tags/9.124.0/
- https://wordpress.org/plugins/vk-all-in-one-expansion-unit/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2542/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.