PT-2025-46271 · WordPress · Authors List

Published 2025-11-11 · Updated 2025-11-11 · CVE-2025-12010

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Authors List plugin for WordPress versions prior to 2.0.6.2

Description The Authors List plugin for WordPress is susceptible to sensitive information exposure. Authenticated attackers with Contributor-level access or higher can exploit this issue by calling methods, such as get meta, through specially crafted shortcode attributes. This allows extraction of sensitive user data, including password hashes, email addresses, usernames, and activation keys. The vulnerability stems from an arbitrary method call within the Authors List Shortcode class.

Recommendations Update the Authors List plugin to version 2.0.6.2 or later.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2025-12010

Affected Products

Authors List

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-12010 · Security Note
• https://plugins.trac.wordpress.org/browser/authors-list/tags/2.0.6.1/includes/class-authors-list-shortcode.php#L852 · Note
• https://plugins.trac.wordpress.org/browser/authors-list/tags/2.0.6.2/includes/class-authors-list-shortcode.php#L868 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/5189c1c0-2d4c-47f5-b8d9-3192a670e586?source=cve · Note
• https://plugins.trac.wordpress.org/browser/authors-list/tags/2.0.6.1/includes/class-authors-list-shortcode.php#L868 · Note
• https://twitter.com/CVEnew/status/1988095331620245878 · Twitter Post