PT-2026-47124 · WordPress · Page-List
CVSS v3.1
4.3
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Page-list plugin for WordPress versions prior to 6.3
Description
Missing authorization occurs in the
pagelist unqprfx ext shortcode() function, specifically within the '[pagelist ext]' and '[pagelistext]' shortcodes. The function accepts attacker-controlled post status, post type, and show meta key attributes and passes them directly into get pages() and get post meta() without verifying if the user has the necessary capabilities to read the matched objects. If the current post lacks child pages, the query is re-issued with child of set to 0, expanding the search to all pages on the site matching the provided status and type. This allows authenticated attackers with contributor-level access or higher to disclose titles, body content, excerpts, and arbitrary post meta of private and draft pages by inserting the shortcode into a draft and previewing it.Recommendations
Update the plugin to a version later than 6.2.
Fix
Missing Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Page-List