PT-2026-5501 · WordPress · Ajax Load More

Angus Girvan · Published 2026-01-31 · Updated 2026-01-31 · CVE-2025-15525

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Ajax Load More – Infinite Scroll, Load More, & Lazy Load plugin for WordPress versions through 7.8.1

Description The Ajax Load More plugin for WordPress has a flaw where data access isn’t properly controlled. Specifically, the parse custom args() function lacks correct authorization checks. This allows attackers who haven’t logged in to view titles and excerpts of posts that are private, drafts, pending publication, scheduled, or in the trash.

Recommendations Update to a version newer than 7.8.1.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2025-15525

Affected Products

Ajax Load More

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-15525 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/d01f4e67-a463-4973-97b1-41a64398686a?source=cve · Note
• https://twitter.com/VulmonFeeds/status/2017472514117575074 · Twitter Post
• https://twitter.com/CVEnew/status/2017471827811926435 · Twitter Post
• https://t.me/cveNotify/150486 · Telegram Post
• https://t.me/CVEtracker/43373 · Telegram Post
• https://plugins.trac.wordpress.org/browser/ajax-load-more/tags/7.8.1/core/classes/class-alm-queryargs.php#L500 · Note