What the vulnerability does
01Description
The List category posts plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 0.95.0 via the sanitize_status. This makes it possible for authenticated attackers, with contributor-level access and above, to extract titles, full content, excerpts, dates, authors, and custom-field metadata of other users' pending-review, scheduled, and trashed posts by embedding a crafted [catlist] shortcode in their own draft and previewing it. This vulnerability is a bypass of the incomplete fix introduced for CVE-2025-11377 in version 0.93.0.
Explanation of Vulnerability in Simple Terms
02Summary
List category posts versions up to 0.95.0 lack proper authorization checks, allowing authenticated users to view data they should not have access to. An attacker with a low-privilege account can read sensitive information by making direct requests to the plugin. The vulnerability affects confidentiality but not data integrity or availability. Update to a version newer than 0.95.0.
What an attacker can do
03Attacker Capabilities
Read data that should be restricted to higher-privilege users.
Potential impact on your site
04Site Impact
Unauthorized users can access restricted post categories and related data.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege account on the site.
Key dates
06Disclosure timeline
July 16, 2026
CVE published
July 16, 2026
Record updated
