CVE-2025-11377: WordPress List Category Posts Plugin Flaw

CVE-2025-11377 Overview

The List Category Posts plugin for WordPress contains an information exposure vulnerability affecting all versions up to and including 0.92.0. The flaw exists in the catlist shortcode, which applies insufficient restrictions on which posts can be included in generated listings. Authenticated users with contributor-level access or higher can craft shortcodes that surface content from password-protected, private, or draft posts they are not authorized to view. The issue is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Contributor-level attackers can extract content from private, draft, and password-protected posts through the catlist shortcode without providing credentials for the target posts.

Affected Products

List Category Posts plugin for WordPress, all versions up to and including 0.92.0
WordPress sites permitting contributor-level or higher registration where the plugin is active
Multisite WordPress installations that expose the plugin to authenticated authors

Discovery Timeline

2025-11-01 - CVE-2025-11377 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11377

Vulnerability Analysis

The List Category Posts plugin provides the catlist shortcode so editors can render lists of posts filtered by category, tag, author, and post status. The shortcode accepts parameters that control which posts appear in the output. In versions through 0.92.0, the shortcode handler does not verify whether the current user has permission to read the posts it is about to render. As a result, WordPress returns post titles, excerpts, and content for items the user could never reach through the standard editor interface.

Any authenticated user at contributor level or above can insert a catlist shortcode into their own draft. Previewing that draft executes the shortcode with the user's session, and the response body includes data from restricted posts. Attackers can iterate through category identifiers, post statuses, and password-protected content to enumerate sensitive material. The confidentiality impact is limited to data accessible through the plugin's query, and the exploit requires an authenticated session rather than fully anonymous access.

Root Cause

The plugin builds its internal WP_Query arguments from user-supplied shortcode attributes without filtering the result set against the caller's read capabilities. WordPress core will honor requests for private, draft, or password-protected posts when the calling code asks for them, so the missing capability check inside the shortcode handler exposes the data directly.

Attack Vector

Exploitation requires an authenticated WordPress account with the edit_posts capability, which is granted by default to the Contributor role. The attacker creates or edits a post, embeds a catlist shortcode configured to include draft, private, or password-protected posts, and then previews or publishes the containing post. The rendered output leaks the restricted content back to the attacker.

No verified public exploit code is available. See the Wordfence vulnerability report and the WordPress plugin changeset for technical details of the fix.

Detection Methods for CVE-2025-11377

Indicators of Compromise

Draft or published posts authored by contributor-level accounts that contain catlist shortcodes referencing unusual status, post_status, or include parameters.
Preview or view requests from contributor accounts to /?p=<id>&preview=true returning HTML that includes titles or excerpts of posts marked private or draft.
New contributor or author registrations shortly followed by heavy shortcode preview activity in access logs.

Detection Strategies

Audit installed plugin versions and flag any List Category Posts installation at or below 0.92.0.
Search post content in the wp_posts table for [catlist ...] shortcodes and review which accounts created them.
Correlate WordPress REST or admin-ajax activity from low-privilege users with responses containing content from posts they do not own.

Monitoring Recommendations

Enable WordPress action logging for post previews, publish events, and shortcode rendering by non-editor roles.
Alert on web server responses to contributor sessions that exceed typical size thresholds when previewing posts.
Review outbound feed and search endpoint traffic for unexpected exposure of draft or private content in cached responses.

How to Mitigate CVE-2025-11377

Immediate Actions Required

Update the List Category Posts plugin to a version above 0.92.0 that contains the fix referenced in the plugin changeset.
Temporarily deactivate the plugin on sites that cannot patch immediately and remove catlist shortcodes authored by untrusted users.
Review contributor and author accounts, revoking access for stale or unrecognized users.

Patch Information

The vendor addressed the issue in the commit tracked by WordPress plugin changeset 3386680. Administrators should upgrade to the first release that includes this changeset. Confirm the installed version in wp-admin under Plugins after updating.

Workarounds

Restrict user registration and remove the Contributor role from users who do not require post authoring.
Filter or strip the catlist shortcode from user-submitted content using a remove_shortcode('catlist') call in a mu-plugin until the update is applied.
Place the WordPress admin area behind additional authentication such as IP allowlisting or HTTP basic auth to reduce exposure from compromised low-privilege accounts.

bash

# Configuration example: disable the vulnerable shortcode until patching
# Save as wp-content/mu-plugins/disable-catlist.php
<?php
add_action('init', function () {
    if (shortcode_exists('catlist')) {
        remove_shortcode('catlist');
    }
}, 20);