PT-2026-47124 · Webvitaly · Page-List

Darkestmode · Published 2026-06-06 · Updated 2026-06-06 · CVE-2026-9008

NVD

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

The Page-list plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 6.2. This is due to the pagelist unqprfx ext shortcode() function (the [pagelist ext] / [pagelistext] shortcode) accepting attacker-controlled post status, post type, and show meta key attributes and passing them directly into get pages() and get post meta() with no capability check verifying that the rendering user is permitted to read the matched objects. When the current post has no child pages, the shortcode re-issues the query with child of => 0, broadening it to every page on the site matching the supplied status/type. This makes it possible for authenticated attackers, with contributor-level access and above, to disclose the titles, body content/excerpts, and arbitrary post meta of unrelated private and draft pages by inserting the shortcode into a contributor-authored draft and previewing it.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-9008

Affected Products

Page-List

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-9008 · Security Note
• https://plugins.trac.wordpress.org/browser/page-list/tags/5.9/page-list.php#L301 · Note
• https://plugins.trac.wordpress.org/browser/page-list/tags/5.9/page-list.php#L188 · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3552931%40page-list&new=3552931%40page-list&sfp_email=&sfph_mail= · Note
• https://plugins.trac.wordpress.org/browser/page-list/tags/5.9/page-list.php#L303 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/22defe19-28ac-43b3-814d-5a2038380adb?source=cve · Note
• https://plugins.trac.wordpress.org/browser/page-list/tags/5.9/page-list.php#L383 · Note