# Logo Carousel <= 4.0.1 - Unauthenticated Sensitive Information Exposure via Password-Protected Logo Carousels

- **ID:** WPSEC-2026-2888
- **Plugin:** Logo Carousel – Responsive Logo Slider, Logo Showcase, and Clients Logo Gallery (`logo-carousel-free`), https://wordpress.org/plugins/logo-carousel-free/
- **Affected versions:** all versions before 4.0.2
- **Fixed in:** 4.0.2 (Update to 4.0.2 or later.)
- **Severity:** Low 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-12)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/logo-carousel-free
- **Fix released:** 2026-11-11
- **Published:** 2026-11-12
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2888/

## Description

The Logo Carousel plugin for WordPress is vulnerable to Sensitive Information Exposure via the logocarousel shortcode in all versions up to, and including, 4.0.1. This is due to the shortcode renderer not checking whether the carousel or the logo posts it displays are password protected. This makes it possible for unauthenticated attackers to view password-protected carousels and the titles and images of password-protected logos on any page where a carousel is embedded, without entering the password. Authenticated attackers with Contributor-level access and above can also embed a protected carousel's ID in their own posts to view it.

## References

- https://wpsec.com/vuln/WPSEC-2026-2888/
- https://plugins.svn.wordpress.org/logo-carousel-free/tags/4.0.2/
- https://wordpress.org/plugins/logo-carousel-free/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2888/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.