CVE-2026-9008: Page-list WordPress Plugin Missing Authorization Vulnerability

Technical summary

CVE-2026-9008 is a missing authorization vulnerability in the Page-list WordPress plugin affecting all versions through 6.2. The pagelist_unqprfx_ext_shortcode() function processes the [pagelist_ext] and [pagelistext] shortcodes without capability checks on attacker-supplied post_status, post_type, and show_meta_key parameters. These parameters are passed directly to WordPress functions get_pages() and get_post_meta(). When a query returns no child pages, the function re-executes with child_of => 0, expanding the scope to all pages matching the supplied filters. This allows extraction of restricted post metadata and content from pages the requesting user should not be able to access. The vulnerability is classified as CWE-862 (Missing Authorization).

Business impact

The exposure is limited to information disclosure but affects confidential page content across WordPress sites using the plugin. Organizations that use private or draft pages to store sensitive information—such as unpublished announcements, internal policies, or confidential client work—face uncontrolled disclosure to any contributor-level user. While the vulnerability requires authentication and deliberate shortcode injection, the risk compounds in multi-author environments or those with elevated contributor access. The CVSS 3.1 score of 4.3 (Medium) reflects the authentication requirement and confidentiality impact without affecting integrity or availability.

Affected systems

All versions of the Page-list WordPress plugin up to and including version 6.2 are affected. The vulnerability targets WordPress environments with active contributor or editor accounts that have permission to draft and preview posts. Organizations using older versions or those with many unpublished pages in draft or private status face elevated risk.

Exploitability

The attack requires valid WordPress authentication (contributor level or above) and the ability to create or edit draft posts and use the preview function. No user interaction is needed beyond the attacker viewing their own preview. The attack is straightforward to execute once a user has draft access, making it a practical concern for environments with distributed authorship or external collaborators. However, the requirement for pre-existing authentication and the lack of escalation pathways limit real-world impact for most organizations.

Remediation

Update the Page-list plugin to a version that includes proper authorization checks in the pagelist_unqprfx_ext_shortcode() function. Verify against the vendor advisory for the specific patched version. Organizations unable to patch immediately should restrict contributor-level permissions to trusted users only and audit draft/private page content for unauthorized access.

Patch guidance

Check the plugin's official repository or vendor advisory for the latest version addressing this vulnerability. Apply the update through the WordPress admin dashboard under Plugins > Installed Plugins > Update, or manually replace the plugin files with the patched version. Test functionality on a staging environment before production deployment to ensure compatibility with custom page queries or extensions. Verify that the shortcode now enforces capability checks matching the current user's edit_posts or read_private_posts permissions.

Detection guidance

Monitor WordPress post revision and preview logs for suspicious shortcode usage, particularly [pagelist_ext] and [pagelistext] with unusual post_status or post_type parameters in draft posts. Audit database query logs for mismatched user permissions accessing private or draft page metadata. Review contributor and editor access logs for users creating and previewing drafts containing these shortcodes. Implement logging of post_meta queries to track extraction of restricted metadata. Check for shortcode usage in posts authored by low-privilege accounts in audit trails.

Why prioritize this

While the CVSS score is moderate, the vulnerability is relevant for organizations with sensitive unpublished content and distributed authorship. The ease of exploitation and the authenticated nature of the flaw position it as a secondary-priority concern that deserves patching in routine maintenance cycles rather than emergency response. Prioritize patching if your environment has high-risk draft or private pages containing financial data, client information, or strategic announcements.

Risk score, explained

The CVSS 3.1 score of 4.3 reflects a network-accessible vulnerability with low attack complexity and low privilege requirements (contributor level). The scope is unchanged, meaning the impact is limited to the vulnerable plugin. Confidentiality is impacted (Low) as restricted page content can be disclosed. Integrity and availability are unaffected. The authentication requirement prevents casual or unauthenticated abuse, preventing a higher severity rating.

Frequently asked questions