CVE-2025-11377

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-11377", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-06T16:21:36.559Z", "datePublished": "2025-11-01T04:27:40.333Z", "dateUpdated": "2026-04-08T16:52:49.591Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:52:49.591Z"}, "affected": [{"vendor": "fernandobt", "product": "List category posts", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "0.92.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The List category posts plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 0.92.0 via the 'catlist' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with contributor-level access and above, to extract data from password protected, private, or draft posts that they should not have access to."}], "title": "List category posts <= 0.92.0 - Authenticated (Contributor+) Information Exposure", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/52666087-3ecc-4901-8902-042179ae97fc?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3386680%40list-category-posts&new=3386680%40list-category-posts&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor", "cweId": "CWE-200", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Athiwat Tiprasaharn"}], "timeline": [{"time": "2025-10-31T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-03T20:45:22.330015Z", "id": "CVE-2025-11377", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-03T20:45:31.296Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-11377", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-03T20:45:22.330015Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-03T20:45:26.343Z"}}], "cna": {"title": "List category posts <= 0.92.0 - Authenticated (Contributor+) Information Exposure", "credits": [{"lang": "en", "type": "finder", "value": "Athiwat Tiprasaharn"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"}}], "affected": [{"vendor": "fernandobt", "product": "List category posts", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "0.92.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-31T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/52666087-3ecc-4901-8902-042179ae97fc?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3386680%40list-category-posts&new=3386680%40list-category-posts&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The List category posts plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 0.92.0 via the 'catlist' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with contributor-level access and above, to extract data from password protected, private, or draft posts that they should not have access to."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-11-01T04:27:40.333Z"}}}, "cveMetadata": {"cveId": "CVE-2025-11377", "state": "PUBLISHED", "dateUpdated": "2025-11-03T20:45:31.296Z", "dateReserved": "2025-10-06T16:21:36.559Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-11-01T04:27:40.333Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "List category posts", "vendor": "fernandobt", "versions": [{"lessThanOrEqual": "0.92.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The List category posts plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 0.92.0 via the 'catlist' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with contributor-level access and above, to extract data from password protected, private, or draft posts that they should not have access to."}, {"lang": "es", "value": "El plugin List category posts para WordPress es vulnerable a la Exposici\u00f3n de Informaci\u00f3n en todas las versiones hasta la 0.92.0, inclusive, a trav\u00e9s del shortcode 'catlist' debido a restricciones insuficientes sobre qu\u00e9 publicaciones pueden incluirse. Esto permite a atacantes autenticados, con acceso de nivel de colaborador y superior, extraer datos de publicaciones protegidas con contrase\u00f1a, privadas o en borrador a las que no deber\u00edan tener acceso."}], "id": "CVE-2025-11377", "lastModified": "2026-10-18T21:10:00.120", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-11377", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-11-03T20:45:22.330015Z", "version": "2.0.3"}}]}, "published": "2025-11-01T05:16:02.037", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3386680%40list-category-posts&new=3386680%40list-category-posts&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/52666087-3ecc-4901-8902-042179ae97fc?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T12:34:53.814512+00:00", "value": {"mitigation_remediation": ["Upgrade the List category posts plugin to a version newer than 0.92.0 or remove the plugin entirely.", "If upgrading is not immediately possible, restrict or remove contributor (and higher) roles from the site, or modify user capabilities to prevent execution of the catlist shortcode.", "Disable or restrict usage of the catlist shortcode in the site\u2019s configuration so that only public posts can be queried."], "summary": {"action": "Assess Impact", "impact": "Information Exposure"}, "threat_synthesis": {"affected_systems": "The flaw exists in all releases of the fernandobt List category posts plugin up to and including version 0.92.0. WordPress sites that have installed that plugin and have users with contributor-level access are susceptible.", "description_and_impact": "The List category posts plugin for WordPress contains an Information Exposure flaw. The vulnerability is tied to the 'catlist' shortcode, where the code fails to enforce proper visibility restrictions, allowing authenticated users with contributor or higher privileges to view posts that are password protected, private, or drafts. This flaw maps to CWE\u2011200 and lets attackers read content they should not see, potentially leaking confidential or unpublished information.", "risk_and_exploitability": "The CVSS score of 4.3 indicates a moderate severity. The EPSS score of less than 1% signals that exploitation is unlikely at this time, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need to authenticate to the WordPress site with at least contributor permissions and then invoke the vulnerable catlist shortcode to enumerate and read posts that are normally hidden. The impact is confined to the data exposure of protected posts, not to code execution or denial of service."}}}}, "created": "2025-11-03T10:43:46.820720+00:00", "updated": "2026-04-22T12:45:17.022173+00:00", "vendors": ["fernandobriano", "fernandobriano$PRODUCT$list_category_posts", "wordpress", "wordpress$PRODUCT$wordpress"]}