Sensitive Information Exposure in List Category Posts Plugin for WordPress

CVE-2026-12434

What is CVE-2026-12434?

The List Category Posts plugin for WordPress has a vulnerability that allows authenticated users with contributor-level or higher access to expose sensitive information. By embedding a specifically crafted [catlist] shortcode within their drafts, these users can reveal details such as titles, full content, excerpts, post dates, authors, and custom-field metadata of other users' posts that are pending review, scheduled, or trashed. This issue arises from an incomplete fix for a previous vulnerability, highlighting the necessity for users to immediately update their plugin to secure their installed WordPress sites against data leaks.

References