Executive brief
The Post Carousel WordPress plugin, used to display posts in grid, carousel, slider, or list layouts on websites, fails to check whether a post is password-protected before returning its content and password. An unauthenticated attacker can retrieve the cleartext password and full content of any password-protected post on an affected site, bypassing the intended access controls and exposing sensitive information.
Technical details
The vulnerability is a sensitive data exposure issue in the sp_handle_post_id AJAX action handler that fails to verify post password protection status. The attack requires harvesting a nonce (which is publicly emitted to anonymous visitors on pages with post blocks) and then sending a POST request to wp-admin/admin-ajax.php with the target post ID. The handler returns the rendered post content and the cleartext post_password value without authorization checks. Private, draft, and pending posts are rejected, limiting scope to published password-protected posts. The vulnerability has been patched in version 4.0.8.
Affected products
- WordPress.org Post Carousel 4.0.0 through 4.0.7
Timeline
- 2026-09-03: disclosed
- 2026-09-05: advisory
- 2026-09-05: patched: Fixed in version 4.0.8