Advanced Posts Listing EUVD-2026-93040

Exploitation requires that the target WordPress site has the 'Advanced Posts Listing - Show Post List Easily' plugin installed and active at version 1.0.8 or earlier; the flaw is reachable against default configurations with no special settings noted. Per the CVSS vector (PR:N/UI:N/AC:L), no authentication, no user interaction, and no elevated privileges are required - a remote attacker can reach the vulnerable endpoint directly. The primary LIMITING factor is deployment: the vulnerability only affects sites running this specific, low-footprint plugin, and impact is confined to confidentiality (C:H, I:N, A:N) - i.e., unauthorized disclosure of post/listing data, not modification or denial of service.

The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 7.5 HIGH) describes a cleanly exploitable network-reachable flaw: no authentication (PR:N), no user interaction (UI:N), and low attack complexity (AC:L), with high confidentiality impact but no integrity or availability impact - consistent with CWE-862 (Missing Authorization) exposing data that should be protected. However, several real-world risk signals are MISSING from the input: there is no EPSS exploitation-probability score, no CISA KEV listing, and no indication of public POC/exploit code. With no public exploit identified at time of analysis and no KEV entry, there is no evidence of active exploitation; the elevated CVSS reflects theoretical ease of exploitation rather than demonstrated in-the-wild attacks. The affected software is a single, low-footprint WordPress plugin reported solely by Patchstack, which sharply limits the realistic blast radius compared to the high CVSS. Net assessment: this is a legitimate patch-worthy issue for the specific sites running the plugin, but it is a high-CVSS/low-aggregate-real-risk item at internet scale given the narrow deployment and absence of exploitation signals - prioritize patching only where this plugin is installed.

An unauthenticated remote attacker sends a crafted HTTP request directly to the vulnerable plugin's endpoint on a WordPress site running Advanced Posts Listing <= 1.0.8, which fails to perform an authorization check (CWE-862). Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, the attacker needs no credentials, no victim interaction, and only a simple request to retrieve post data or listings that should be access-restricted. No public exploit code is identified at time of analysis, so exploitation would currently require an attacker to craft the request themselves.