CVE-2025-12010 Overview
The Authors List plugin for WordPress contains a sensitive information exposure vulnerability affecting all versions up to and including 2.0.6.1. The flaw resides in the Authors_List_Shortcode class, which permits arbitrary method invocation through specially crafted shortcode attributes. Authenticated users with Contributor-level access or above can call internal methods such as get_meta to read user metadata that should remain restricted. Exposed data includes password hashes, email addresses, usernames, and account activation keys. The vulnerability is tracked under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.
Critical Impact
Authenticated Contributors can extract WordPress user password hashes and activation keys, enabling offline credential cracking and account takeover of administrator accounts.
Affected Products
- Authors List plugin for WordPress — all versions through 2.0.6.1
- Fixed in version 2.0.6.2
- Any WordPress site allowing Contributor-level registration with this plugin installed
Discovery Timeline
- 2025-11-11 - CVE-2025-12010 published to the National Vulnerability Database
- 2026-10-18 - Entry last modified in NVD
Technical Details for CVE-2025-12010
Vulnerability Analysis
The Authors List plugin exposes a shortcode handler that dispatches method calls based on user-controlled attributes. The Authors_List_Shortcode class does not restrict which internal methods a shortcode consumer may invoke. Because shortcodes can be embedded in post content by Contributors, any authenticated user at that privilege tier can trigger arbitrary method execution within the class context.
One reachable method, get_meta, returns raw WordPress user metadata. WordPress stores sensitive fields alongside profile data, including the hashed password in user_pass, the primary email in user_email, the login name in user_login, and the password reset token in user_activation_key. Returning these fields through a public-facing shortcode renders them accessible to the attacker who authored the post.
An attacker can harvest administrator password hashes and feed them to offline cracking tools, or request an activation key to reset credentials without triggering the standard password-reset email verification.
Root Cause
The root cause is missing allow-list validation on the method dispatch path inside Authors_List_Shortcode. The class treats shortcode attributes as trusted method selectors instead of mapping attributes to a fixed set of safe operations. There is no capability check restricting metadata retrieval to administrators.
Attack Vector
Exploitation requires an authenticated session with Contributor privileges or higher. The attacker drafts a post or page containing the plugin's shortcode with attributes that select a sensitive method such as get_meta and target the administrator user ID. When the shortcode renders, the returned HTML contains the sensitive values. See the Wordfence Vulnerability Report and the vulnerable code at class-authors-list-shortcode.php L852 and L868 for the technical specifics.
Detection Methods for CVE-2025-12010
Indicators of Compromise
- Draft or published posts authored by Contributor accounts containing the Authors List shortcode with unusual attribute names referencing method identifiers such as get_meta.
- Rendered page output containing bcrypt-formatted password hash prefixes ($P$, $wp$, $2y$) or user_activation_key values.
- Unexpected password reset activity for administrator accounts shortly after Contributor logins.
Detection Strategies
- Audit the WordPress posts table for shortcode occurrences invoking the Authors List plugin and inspect attribute values for method-like strings.
- Review web server access logs for GET requests to pages authored by low-privilege users that return response bodies larger than expected or containing hash-like patterns.
- Correlate Contributor logins with subsequent administrator password changes or failed MFA challenges.
Monitoring Recommendations
- Enable WordPress audit logging for post creation, post preview, and user metadata reads.
- Monitor outbound traffic from the web host for exfiltration of large user records following shortcode rendering.
- Alert on any administrator password reset initiated without a preceding reset email delivery event.
How to Mitigate CVE-2025-12010
Immediate Actions Required
- Update the Authors List plugin to version 2.0.6.2 or later on every WordPress installation.
- Rotate all administrator and editor passwords, assuming hashes may have been exfiltrated.
- Invalidate outstanding user_activation_key values by forcing a password reset cycle for privileged accounts.
- Review Contributor accounts and remove any that are unrecognized or inactive.
Patch Information
The maintainer addressed the issue in Authors List version 2.0.6.2. The patched shortcode handler is published at class-authors-list-shortcode.php L868 (2.0.6.2). Site owners should apply the update through the WordPress plugin manager or via WP-CLI.
Workarounds
- Deactivate the Authors List plugin until the patched version is installed.
- Restrict post authoring to Editor or Administrator roles by removing the edit_posts capability from the Contributor role.
- Deploy a web application firewall rule that strips Authors List shortcodes containing attributes matching PHP method name patterns.
# Update the plugin using WP-CLI
wp plugin update authors-list --version=2.0.6.2
# Verify installed version
wp plugin get authors-list --field=version
# Force password reset for all administrators
wp user list --role=administrator --field=ID | \
xargs -I {} wp user reset-password {} --skip-email
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
