PT-2026-5501 · WordPress · Ajax Load More

Angus Girvan · Publicado 2026-01-31 · Atualizado 2026-01-31 · CVE-2025-15525

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Ajax Load More – Infinite Scroll, Load More, & Lazy Load plugin for WordPress versions through 7.8.1

Description The Ajax Load More plugin for WordPress has a flaw where data access isn’t properly controlled. Specifically, the parse custom args() function lacks correct authorization checks. This allows attackers who haven’t logged in to view titles and excerpts of posts that are private, drafts, pending publication, scheduled, or in the trash.

Recommendations Update to a version newer than 7.8.1.

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

CVE-2025-15525

Produtos afetados

Ajax Load More

Referências · 7

• https://wordfence.com/threat-intel/vulnerabilities/id/d01f4e67-a463-4973-97b1-41a64398686a?source=cve · Nota
• https://twitter.com/VulmonFeeds/status/2017472514117575074 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2017471827811926435 · Publicação no Twitter
• https://t.me/cveNotify/150486 · Publicação no Telegram
• https://t.me/CVEtracker/43373 · Publicação no Telegram
• https://plugins.trac.wordpress.org/browser/ajax-load-more/tags/7.8.1/core/classes/class-alm-queryargs.php#L500 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-15525 · Nota de Segurança