CVE-2026-9008 Overview
CVE-2026-9008 is a Missing Authorization vulnerability [CWE-862] affecting the Page-list plugin for WordPress in all versions up to and including 6.2. The flaw resides in the pagelist_unqprfx_ext_shortcode() function backing the [pagelist_ext] and [pagelistext] shortcodes. The function accepts attacker-controlled post_status, post_type, and show_meta_key attributes and passes them directly to get_pages() and get_post_meta() without verifying that the rendering user can read the matched objects. Authenticated users with contributor-level access or above can disclose titles, content, excerpts, and arbitrary post meta from private and draft pages.
Critical Impact
Contributor-level accounts can read unpublished private and draft page content, including arbitrary post meta, by embedding a crafted shortcode in a draft and previewing it.
Affected Products
- WordPress Page-list plugin versions up to and including 6.2
- WordPress sites permitting contributor-level registration or self-service signup
- Multi-author WordPress environments using the [pagelist_ext] shortcode
Discovery Timeline
- 2026-06-06 - CVE-2026-9008 published to the National Vulnerability Database
- 2026-06-08 - Last updated in NVD database
Technical Details for CVE-2026-9008
Vulnerability Analysis
The Page-list plugin exposes the [pagelist_ext] shortcode to render lists of child pages from the current post context. The handler reads shortcode attributes supplied by the rendering user and forwards them to WordPress core query functions without capability gating. Because shortcode output is generated in the post author's request context but reflects data the author may not be entitled to read, the plugin breaches the WordPress access-control model.
The shortcode supports post_status and post_type attributes, letting a contributor force inclusion of private, draft, pending, or arbitrary custom post types. The show_meta_key attribute additionally instructs the plugin to call get_post_meta() and emit the value in the rendered output. None of these attribute paths perform a current_user_can() check against the returned objects.
Root Cause
The root cause is the absence of an authorization check between the user-supplied shortcode attributes and the data retrieval calls. WordPress core functions like get_pages() and get_post_meta() do not enforce per-user read permissions; that responsibility belongs to the caller. The plugin trusts shortcode input rather than validating whether the rendering account holds read_private_pages or equivalent capabilities for each returned object.
Attack Vector
An authenticated attacker with contributor privileges creates a draft post containing [pagelist_ext post_status="private,draft" post_type="page" show_meta_key="<target_meta>"]. When the contributor previews the draft, the shortcode executes server-side. If the current post has no child pages, the plugin re-issues the query with child_of => 0, broadening the result set to every page on the site matching the supplied status and type. The rendered preview returns titles, body content, excerpts, and the requested meta values for unrelated private and draft pages.
No code execution or data modification is possible through this flaw — the impact is limited to confidentiality of page content and post meta.
Detection Methods for CVE-2026-9008
Indicators of Compromise
- Contributor or author-authored drafts containing [pagelist_ext] or [pagelistext] shortcodes with post_status values such as private, draft, or pending
- Shortcode invocations referencing show_meta_key attributes targeting sensitive meta keys
- Frequent preview requests (preview=true query parameters) from low-privilege accounts to draft posts
Detection Strategies
- Scan the wp_posts table for shortcode patterns matching pagelist_ext or pagelistext with non-default post_status or post_type attributes
- Audit web server logs for preview_nonce requests originating from contributor accounts followed by access to unrelated draft URLs
- Correlate plugin presence with the installed version using the wp plugin list CLI to identify hosts running Page-list 6.2 or earlier
Monitoring Recommendations
- Track creation of new contributor or author accounts and subsequent draft submissions referencing list-rendering shortcodes
- Alert on bulk preview activity from a single low-privilege session within short time windows
- Monitor outbound rendering of post meta values associated with private content in HTTP responses to authenticated low-privilege sessions
How to Mitigate CVE-2026-9008
Immediate Actions Required
- Update the Page-list plugin to the patched release published after version 6.2 referenced in the WordPress plugin changeset
- Review and remove unnecessary contributor and author accounts, especially on sites accepting self-service registration
- Audit existing drafts for use of [pagelist_ext] and [pagelistext] shortcodes with non-default attributes
Patch Information
The vendor addressed the issue in a subsequent release tracked in the WordPress Changeset. Detailed analysis of the affected code paths is available in the Wordfence Vulnerability Analysis and the WordPress Page List Source.
Workarounds
- Deactivate the Page-list plugin until the patched version is deployed
- Restrict contributor registration and require editor-level review before any draft is previewed externally
- Apply a web application firewall rule blocking [pagelist_ext] shortcodes containing post_status attributes referencing non-public statuses
# Verify the installed Page-list plugin version and update via WP-CLI
wp plugin get page-list --field=version
wp plugin update page-list
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
