CVE-2025-27310: Page and Post Lister Auth Bypass Flaw

CVE-2025-27310 Overview

CVE-2025-27310 is a missing authorization vulnerability in the Radius of Thought Page and Post Lister WordPress plugin (page-and-post-lister). The flaw affects all versions up to and including 1.2.1. It stems from incorrectly configured access control on plugin functionality, allowing authenticated users with low privileges to trigger actions they should not access. Exploitation can result in arbitrary content deletion within the WordPress site. The issue is tracked under CWE-862: Missing Authorization.

Critical Impact
Authenticated attackers with low-level privileges can delete arbitrary content on affected WordPress sites, disrupting site availability and integrity.

Affected Products

Radius of Thought Page and Post Lister plugin for WordPress
All versions from n/a through 1.2.1
WordPress sites with the page-and-post-lister plugin installed and active

Discovery Timeline

2025-04-17 - CVE-2025-27310 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-27310

Vulnerability Analysis

The Page and Post Lister plugin exposes functionality without adequate authorization checks. An authenticated user, including low-privileged roles such as Subscriber, can invoke plugin actions intended for administrators. Because the plugin does not verify the requesting user's capability before performing content operations, attackers can delete pages, posts, or other managed content arbitrarily.

The vulnerability is remotely exploitable over the network with low attack complexity. Successful exploitation degrades site availability by removing content, though confidentiality and data integrity in the traditional sense are not directly impacted. The EPSS probability sits at 0.396% at the 32.7th percentile, indicating limited observed exploitation attempts.

Root Cause

The root cause is a missing capability check (CWE-862) on privileged plugin endpoints. WordPress plugins typically enforce authorization using current_user_can() alongside nonce validation via check_admin_referer() or wp_verify_nonce(). The affected plugin fails to gate content-mutating actions behind these checks, allowing any authenticated session to invoke them.

Attack Vector

An attacker requires only a valid low-privilege WordPress account to exploit the flaw. After authenticating, the attacker sends crafted HTTP requests to plugin endpoints handling content actions. The server processes these requests without verifying that the caller holds edit_posts, delete_posts, or comparable capabilities. Content is removed regardless of ownership or user role. Refer to the Patchstack Vulnerability Report for additional technical detail.

Detection Methods for CVE-2025-27310

Indicators of Compromise

Unexpected deletion of posts or pages without corresponding administrator activity in the WordPress audit log
HTTP requests to page-and-post-lister plugin endpoints originating from non-administrator user sessions
Spikes in wp_posts table DELETE operations correlated with low-privilege user logins

Detection Strategies

Inventory WordPress installations and identify sites running page-and-post-lister version 1.2.1 or earlier
Monitor web server access logs for POST requests to plugin-specific admin-ajax or REST endpoints from Subscriber-level accounts
Enable a WordPress activity logging plugin to record content deletion events with the actor's user ID and role

Monitoring Recommendations

Alert on any content deletion action performed by users below the Editor role
Track authentication events for newly created low-privilege accounts followed by immediate plugin endpoint access
Correlate database change events with authenticated session identifiers to identify unauthorized modifications

How to Mitigate CVE-2025-27310

Immediate Actions Required

Identify all WordPress installations using the Page and Post Lister plugin and confirm the installed version
Deactivate the plugin on any site running version 1.2.1 or earlier until a patched release is verified
Restrict user registration and audit existing low-privilege accounts for suspicious activity
Back up WordPress content and databases before applying updates or removal steps

Patch Information

At the time of the most recent NVD update, the Patchstack Vulnerability Report lists all versions up to 1.2.1 as affected. Administrators should consult the Patchstack advisory and the WordPress plugin repository for the latest fixed release before re-enabling the plugin.

Workarounds

Disable the page-and-post-lister plugin until a fixed version is confirmed and installed
Apply a Web Application Firewall (WAF) rule blocking requests to plugin endpoints from non-administrator sessions
Remove user registration or downgrade default new-user roles to prevent creation of exploitable low-privilege accounts
Enforce least-privilege role assignments and audit capabilities granted to existing accounts

bash

# Disable the vulnerable plugin using WP-CLI
wp plugin deactivate page-and-post-lister
wp plugin status page-and-post-lister

# Optional: remove the plugin entirely until a patched version is available
wp plugin uninstall page-and-post-lister