Executive brief
The List category posts plugin for WordPress, which allows users to display lists of posts on pages or posts, contains a security flaw. This vulnerability allows logged-in users with basic contributor permissions to view private information they should not have access to, such as the full content and metadata of posts that are still drafts, scheduled for future publication, or in the trash. This could lead to the unauthorized disclosure of sensitive internal information or upcoming announcements before they are ready for the public.
Technical details
The List category posts plugin for WordPress is vulnerable to sensitive information exposure due to improper authorization checks in the 'sanitize_status' function. Authenticated attackers with contributor-level access or higher can exploit this by embedding a crafted [catlist] shortcode into a post draft and previewing it. This bypasses intended restrictions to extract sensitive data—including titles, full content, excerpts, and custom-field metadata—from posts that are pending review, scheduled, or trashed. This vulnerability is a bypass of an incomplete fix previously implemented for CVE-2025-11377. The issue affects all versions up to and including 0.95.0.
Affected products
- fernandobt List category posts up to, and including, 0.95.0
Timeline
- 2026-07-16: disclosed
- 2026-07-16: advisory
References
- https://plugins.trac.wordpress.org/browser/list-category-posts/tags/0.95.0/include/lcp-catlist.php
- https://plugins.trac.wordpress.org/browser/list-category-posts/tags/0.95.0/include/lcp-catlist.php
- https://plugins.trac.wordpress.org/browser/list-category-posts/tags/0.95.0/include/lcp-parameters.php
- https://plugins.trac.wordpress.org/browser/list-category-posts/tags/0.95.0/list-category-posts.php
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3598587%40list-category-posts&new=3598587%40list-category-posts
- https://www.wordfence.com/threat-intel/vulnerabilities/id/3477baf1-71ef-44f3-938f-3e7d710e9df6?source=cve