{
 "id": "WPSEC-2026-2888",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2888/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2888/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2888/index.md",
 "title": "Logo Carousel <= 4.0.1 - Unauthenticated Sensitive Information Exposure via Password-Protected Logo Carousels",
 "description": "The Logo Carousel plugin for WordPress is vulnerable to Sensitive Information Exposure via the logocarousel shortcode in all versions up to, and including, 4.0.1. This is due to the shortcode renderer not checking whether the carousel or the logo posts it displays are password protected. This makes it possible for unauthenticated attackers to view password-protected carousels and the titles and images of password-protected logos on any page where a carousel is embedded, without entering the password. Authenticated attackers with Contributor-level access and above can also embed a protected carousel's ID in their own posts to view it.",
 "plugin": {
  "slug": "logo-carousel-free",
  "name": "Logo Carousel",
  "full_name": "Logo Carousel – Responsive Logo Slider, Logo Showcase, and Clients Logo Gallery",
  "wordpress_org": "https://wordpress.org/plugins/logo-carousel-free/",
  "advisories_url": "https://wpsec.com/vuln/plugin/logo-carousel-free/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/logo-carousel-free"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 3.7,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Low"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "4.0.2",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 4.0.2"
  ]
 },
 "introduced_in": null,
 "fixed_in": "4.0.2",
 "remediation": "Update to 4.0.2 or later.",
 "fix_released": "2026-11-11T06:18:23+00:00",
 "published": "2026-11-12T17:52:14+00:00",
 "updated": "2026-11-12T17:08:21.746507+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2888/",
  "https://plugins.svn.wordpress.org/logo-carousel-free/tags/4.0.2/",
  "https://wordpress.org/plugins/logo-carousel-free/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/logo-carousel-free",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-12"
 }
}