What is the CVSS score of CVE-2026-12434?

CVE-2026-12434 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

List Category Posts CVE-2026-12434

EUVD-2026-44856 MEDIUM

Missing Authorization (CWE-862)

2026-07-16 Wordfence

GHSA-w939-c8qp-6hm2

WordPress Authentication Bypass Information Disclosure List Category Posts Wordpress Plugin

4.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network-accessible shortcode rendering with low complexity; contributor account required (PR:L); confidentiality-only impact on non-public post data, no integrity or availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 16, 2026 - 03:45 vuln.today

CVE Published

Jul 16, 2026 - 02:30 cve.org

MEDIUM 4.3

DescriptionCVE.org

The List category posts plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 0.95.0 via the sanitize_status. This makes it possible for authenticated attackers, with contributor-level access and above, to extract titles, full content, excerpts, dates, authors, and custom-field metadata of other users' pending-review, scheduled, and trashed posts by embedding a crafted [catlist] shortcode in their own draft and previewing it. This vulnerability is a bypass of the incomplete fix introduced for CVE-2025-11377 in version 0.93.0.

AnalysisAI

Sensitive information exposure in the List Category Posts WordPress plugin (all versions through 0.95.0) allows authenticated contributors to read non-public posts belonging to other users - including pending-review, scheduled, and trashed content with full body text, excerpts, authors, and custom-field metadata. Exploitation requires only a contributor-level account and the ability to embed the native [catlist] shortcode in a draft post, then preview it, triggering the flawed sanitize_status logic. This is a confirmed bypass of the incomplete authorization fix shipped in version 0.93.0 for CVE-2025-11377, indicating the root authorization flaw was never fully remediated. No public exploit code or CISA KEV listing is identified at time of analysis.

Technical ContextAI

The List Category Posts plugin (CPE: cpe:2.3:a:fernandobt:list_category_posts:*:*:*:*:*:*:*:*) provides a [catlist] WordPress shortcode for displaying categorized post lists. The vulnerability is rooted in CWE-862 (Missing Authorization): the sanitize_status function - referenced in lcp-parameters.php at line 208 and consumed in lcp-catlist.php at lines 94 and 623 - does not correctly gate which post statuses a lower-privileged user may query. When a contributor embeds a crafted shortcode that requests posts in 'pending', 'future' (scheduled), or 'trash' status and previews their unpublished draft, WordPress renders the shortcode server-side before publishing, allowing the plugin's query to bypass the post-visibility checks that would normally restrict access to another author's non-public content. The same logical gap persisted after the partial fix in 0.93.0, confirming the prior patch did not cover all status-bypass vectors.

RemediationAI

A source-level fix has been committed to the plugin's Subversion repository as changeset 3598587 (https://plugins.trac.wordpress.org/changeset?reponame=&old=3598587%40list-category-posts&new=3598587%40list-category-posts); however, a tagged release version incorporating this fix is not confirmed in the available data, so administrators should monitor the WordPress.org plugin page for a version above 0.95.0 and upgrade as soon as it is published. As an interim compensating control, site administrators should audit which users hold contributor-level roles or above and remove that capability from untrusted accounts, since exploitation requires a contributor account. Alternatively, if the [catlist] shortcode is not needed for contributor-authored content, the shortcode can be unregistered via a mu-plugin filter (remove_shortcode('catlist')) - note this will break the feature for all non-admin roles. Given that this is a second bypass of the same underlying flaw, administrators should verify the fix is substantive by reviewing the changeset before relying solely on the version bump.