CVE-2025-1322 Overview
CVE-2025-1322 affects the WP-Recall – Registration, Profile, Commerce & More plugin for WordPress. The vulnerability exposes protected content through the feed shortcode due to insufficient restrictions on which posts can be included. Authenticated attackers with low privileges can view data from password-protected, private, or draft posts they should not access. All plugin versions up to and including 16.26.10 are affected. The flaw is tracked under CWE-200 (Information Exposure) and CWE-22 (Path Traversal).
Critical Impact
Attackers with minimal privileges can retrieve confidential content from private, draft, and password-protected WordPress posts, leading to sensitive data disclosure.
Affected Products
- Plechevandrey WP-Recall plugin for WordPress, versions ≤ 16.26.10
- WordPress sites using the feed shortcode from WP-Recall
- All WP-Recall installations with the rcl-chat add-on component
Discovery Timeline
- 2025-03-08 - CVE-2025-1322 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-1322
Vulnerability Analysis
The vulnerability resides in the feed shortcode handler within the WP-Recall plugin's rcl-chat add-on. The shortcode aggregates and displays post content without validating the post status or access restrictions of the underlying items. WordPress natively enforces visibility rules for private, draft, and password-protected posts. The feed shortcode bypasses these checks and returns post content directly to any low-privileged authenticated user who can trigger the shortcode.
An attacker with a basic subscriber-level account can leverage the shortcode to enumerate and read restricted content. The disclosed data may include unpublished articles, internal notes, or password-protected posts containing sensitive business information. The vulnerability does not permit modification or denial of service, limiting impact to confidentiality.
Root Cause
The root cause is missing authorization logic in the shortcode's post query. The plugin queries posts and returns their content without calling WordPress capability checks such as current_user_can( 'read_private_posts' ) or verifying post_status and post_password fields. The patch referenced in the vendor changeset 3250094 modifies add-on/rcl-chat/core.php to enforce these restrictions.
Attack Vector
Exploitation requires network access to a vulnerable WordPress site and a low-privileged authenticated account. The attacker embeds or triggers the feed shortcode with parameters that reference the restricted post identifiers. The plugin returns the protected content in the rendered response. No user interaction from an administrator is required, and no complex exploitation chain is needed.
The vulnerability manifests in the feed shortcode logic inside add-on/rcl-chat/core.php. See the Wordfence Vulnerability Report for technical details on the affected function and the corresponding patch.
Detection Methods for CVE-2025-1322
Indicators of Compromise
- Unexpected requests from low-privileged accounts to pages or endpoints that render the feed shortcode
- Access log entries showing subscriber-level users retrieving content associated with private or draft post IDs
- Anomalous traffic spikes targeting WordPress URLs that embed WP-Recall shortcodes
Detection Strategies
- Review WordPress access logs for authenticated requests referencing shortcode parameters targeting post_status=private or draft IDs
- Audit WP-Recall plugin usage across managed WordPress sites and confirm installed version against 16.26.10
- Correlate low-privileged user session activity with responses containing content from restricted posts
Monitoring Recommendations
- Enable WordPress audit logging plugins to capture shortcode invocations and post read events
- Alert on subscriber or contributor accounts accessing unusually large volumes of content
- Monitor for repeated requests to WP-Recall endpoints that return HTTP 200 responses containing draft or private post markup
How to Mitigate CVE-2025-1322
Immediate Actions Required
- Update the WP-Recall plugin to the version released after changeset 3250094 immediately
- Audit all existing subscriber and low-privileged accounts and remove any that are unnecessary
- Review private, draft, and password-protected post content for evidence of unauthorized disclosure
Patch Information
The vendor addressed the vulnerability in the WP-Recall plugin via WordPress plugin changeset 3250094. The fix modifies add-on/rcl-chat/core.php to enforce post visibility checks within the feed shortcode handler. Site administrators should install the patched release from the official WordPress plugin repository.
Workarounds
- Disable the WP-Recall plugin until the patched version can be deployed
- Remove or restrict use of the feed shortcode across published pages and posts
- Restrict new user registration to prevent unauthenticated attackers from obtaining low-privileged accounts
# Verify installed WP-Recall version via WP-CLI
wp plugin get wp-recall --field=version
# Update WP-Recall to the latest patched release
wp plugin update wp-recall
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
