# VK Filter Search <= 2.20.7 - Unauthenticated Sensitive Information Exposure via 'post_type' Parameter

- **ID:** WPSEC-2026-3026
- **Plugin:** VK Filter Search (`vk-filter-search`), https://wordpress.org/plugins/vk-filter-search/
- **Affected versions:** all versions before 2.22.2
- **Fixed in:** 2.22.2 (Update to 2.22.2 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-13)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/vk-filter-search
- **Fix released:** 2026-11-12
- **Published:** 2026-11-13
- **URL:** https://wpsec.com/vuln/WPSEC-2026-3026/

## Description

The VK Filter Search plugin for WordPress is vulnerable to Sensitive Information Exposure via the 'post_type' and 'vkfs_post_type' parameters in all versions up to, and including, 2.20.7. This is due to the plugin passing user-supplied post types directly into the search query without restricting them to public or publicly queryable post types. This makes it possible for unauthenticated attackers to query and view content from non-public post types through the site search.

## References

- https://wpsec.com/vuln/WPSEC-2026-3026/
- https://plugins.svn.wordpress.org/vk-filter-search/tags/2.22.2/
- https://wordpress.org/plugins/vk-filter-search/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-3026/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.