Information Exposure Vulnerability in List Category Posts Plugin for WordPress

CVE-2025-11377

What is CVE-2025-11377?

The List Category Posts plugin for WordPress is susceptible to information exposure, allowing authenticated users with contributor access or higher to bypass restrictions. This vulnerability arises through the 'catlist' shortcode, which does not sufficiently limit access to posts marked as password protected, private, or in draft mode. Consequently, attackers can exploit this flaw to access sensitive content that is not meant for their viewing. It is crucial for website administrators to assess their installations and apply any available updates to prevent potential unauthorized access to sensitive information.

References