HomeWordPress vulnerabilitiesSmart Post
Smart Post vulnerabilities
Smart Post has 3 known vulnerabilities in this database. The most recent published record is dated 5 Sep 2026.
- Known vulnerabilities
- 3
- Active installs
- 20,000+
- Latest version
- 4.0.8
- Last updated
- 2 Sep 2026
- Most recent
- 5 Sep 2026
Find it in your WordPress dashboard under Plugins. Severity is based on the CVSS score published with the CVE where one is available.
| Vulnerability | Severity | Affected | Fix | Published |
|---|---|---|---|---|
| Sensitive data exposure CVE-2026-78149 | Medium 5.3 | Before 4.0.8 | Fixed in 4.0.8 | 5 Sep 2026 |
| Broken access control CVE-2026-78150 | Low 2.7 | Before 4.0.8 | Fixed in 4.0.8 | 5 Sep 2026 |
| PHP object injection CVE-2026-3017 | High 7.2 | Up to 3.0.12 | Fixed in a later version (latest 4.0.8) | 14 Apr 2026 |
Read the published descriptions
- CVE-2026-78149, 5 Sep 2026
- The Smart Post WordPress plugin before 4.0.8 does not check whether a post is password protected before returning its content and its stored password through an unauthenticated AJAX action, allowing unauthenticated users to read protected post content and the password that guards it. CVE record
- CVE-2026-78150, 5 Sep 2026
- The Smart Post WordPress plugin before 4.0.8 does not check the type, ownership or status of the post it is asked to duplicate, allowing users with contributor privileges and above to copy any private or password protected post into a draft of their own and read its content and metadata. CVE record
- CVE-2026-3017, 14 Apr 2026
- The Smart Post Show - Post Grid, Post Carousel & Slider, and List Category Posts plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.0.12 via deserialization of untrusted input in the import_shortcodes() function. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. CVE record
What to do if you run Smart Post
If you run Smart Post, open WordPress and check the installed version in Plugins. Compare it with the affected versions in the vulnerability record. If a fixed version is available, take a current backup and update to that version or the latest supported release.
If no fixed version exists, consider disabling and removing the plugin or replacing it with a maintained alternative. After dealing with the affected software, check administrator users, unexpected file changes, redirects, unfamiliar pages and security logs for signs that the site may already have been altered.
Email me about new Smart Post vulnerabilities
Free. We email you when a new vulnerability is published for Smart Post, usually within minutes. Confirm by email; unsubscribe any time.
Focus on your business. We’ll take care of your website.
From everyday updates to ongoing care, we keep your website working.