Page-list <= 6.2 — Missing Authorization to Authenticated (Contributor+) Sensitive Information Disclosure via Shortcode Attributes

Am I affected?

• Check your version: in wp-admin go to Plugins → Installed Plugins and read the version under Page-list.
• No admin access? Run a passive check of your site. It reads public files only.

What to do

1. Update to version 6.3, or a newer patched version
2. Rotate administrator passwords and application secrets if the site ran a vulnerable version while publicly reachable.
3. Watch Page-list to get an email when the next vulnerability is published.

Advisory

Source description from Wordfence Intelligence, credited to normaandersonfrank.

The Page-list plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 6.2. This is due to the pagelist_unqprfx_ext_shortcode() function (the [pagelist_ext] / [pagelistext] shortcode) accepting attacker-controlled post_status, post_type, and show_meta_key attributes and passing them directly into get_pages() and get_post_meta() with no capability check verifying that the rendering user is permitted to read the matched objects. When the current post has no child pages, the shortcode re-issues the query with child_of => 0, broadening it to every page on the site matching the supplied status/type. This makes it possible for authenticated attackers, with contributor-level access and above, to disclose the titles, body content/excerpts, and arbitrary post meta of unrelated private and draft pages by inserting the shortcode into a contributor-authored draft and previewing it.

Exploits & references

Proof-of-concept & detection

No public proof-of-concept or detection template is known for this vulnerability.

Advisories & patches

• Advisorywordfence.com

Related CVEs

Timeline

1. Jun 5, 2026

   CVE published

   Severity medium, CVSS 4.3

2. Nov 13, 2026

   Record last updated