Logo Carousel <= 4.0.1 - Unauthenticated Sensitive Information Exposure via Password-Protected Logo Carousels
- ID
- WPSEC-2026-2888
- Plugin
- Logo Carousel – Responsive Logo Slider, Logo Showcase, and Clients Logo Gallery (logo-carousel-free)
- Affected
- all versions before 4.0.2
- Remediation
- Update to 4.0.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-12
- Attack surface
- Logo Carousel on WPSec AttackSurface
- Fix released
- Published
Description
The Logo Carousel plugin for WordPress is vulnerable to Sensitive Information Exposure via the logocarousel shortcode in all versions up to, and including, 4.0.1. This is due to the shortcode renderer not checking whether the carousel or the logo posts it displays are password protected. This makes it possible for unauthenticated attackers to view password-protected carousels and the titles and images of password-protected logos on any page where a carousel is embedded, without entering the password. Authenticated attackers with Contributor-level access and above can also embed a protected carousel's ID in their own posts to view it.
References
- https://wpsec.com/vuln/WPSEC-2026-2888/
- https://plugins.svn.wordpress.org/logo-carousel-free/tags/4.0.2/
- https://wordpress.org/plugins/logo-carousel-free/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS