CVE-2025-15525

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-15525", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-01-15T10:30:43.321Z", "datePublished": "2026-01-31T04:35:15.222Z", "dateUpdated": "2026-04-08T17:24:49.375Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:24:49.375Z"}, "affected": [{"vendor": "dcooney", "product": "Ajax Load More \u2013 Infinite Scroll, Load More, & Lazy Load", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "7.8.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Ajax Load More \u2013 Infinite Scroll, Load More, & Lazy Load plugin for WordPress is vulnerable to unauthorized access of data due to incorrect authorization on the parse_custom_args() function in all versions up to, and including, 7.8.1. This makes it possible for unauthenticated attackers to expose the titles and excerpts of private, draft, pending, scheduled, and trashed posts."}], "title": "Ajax Load More \u2013 Infinite Scroll, Lazy Load & Load More <= 7.8.1 - Incorrect Authorization to Unauthenticated Private/Draft Post Title and Excerpt Exposure", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d01f4e67-a463-4973-97b1-41a64398686a?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/ajax-load-more/tags/7.8.1/core/classes/class-alm-queryargs.php#L500"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-863 Incorrect Authorization", "cweId": "CWE-863", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Angus Girvan"}], "timeline": [{"time": "2025-12-31T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2026-01-30T16:20:53.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-02T17:57:20.787024Z", "id": "CVE-2025-15525", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-02T17:57:31.920Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-15525", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-02T17:57:20.787024Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-02T17:57:28.041Z"}}], "cna": {"title": "Ajax Load More \u2013 Infinite Scroll, Lazy Load & Load More <= 7.8.1 - Incorrect Authorization to Unauthenticated Private/Draft Post Title and Excerpt Exposure", "credits": [{"lang": "en", "type": "finder", "value": "Angus Girvan"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}}], "affected": [{"vendor": "dcooney", "product": "Ajax Load More \u2013 Infinite Scroll, Load More, & Lazy Load", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "7.8.1"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-31T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2026-01-30T16:20:53.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d01f4e67-a463-4973-97b1-41a64398686a?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/ajax-load-more/tags/7.8.1/core/classes/class-alm-queryargs.php#L500"}], "descriptions": [{"lang": "en", "value": "The Ajax Load More \u2013 Infinite Scroll, Load More, & Lazy Load plugin for WordPress is vulnerable to unauthorized access of data due to incorrect authorization on the parse_custom_args() function in all versions up to, and including, 7.8.1. This makes it possible for unauthenticated attackers to expose the titles and excerpts of private, draft, pending, scheduled, and trashed posts."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863 Incorrect Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:24:49.375Z"}}}, "cveMetadata": {"cveId": "CVE-2025-15525", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:24:49.375Z", "dateReserved": "2026-01-15T10:30:43.321Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-01-31T04:35:15.222Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Ajax Load More \u2013 Infinite Scroll, Load More, & Lazy Load", "vendor": "dcooney", "versions": [{"lessThanOrEqual": "7.8.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Ajax Load More \u2013 Infinite Scroll, Load More, & Lazy Load plugin for WordPress is vulnerable to unauthorized access of data due to incorrect authorization on the parse_custom_args() function in all versions up to, and including, 7.8.1. This makes it possible for unauthenticated attackers to expose the titles and excerpts of private, draft, pending, scheduled, and trashed posts."}, {"lang": "es", "value": "El plugin Ajax Load More \u2013 Infinite Scroll, Load More, &amp; Lazy Load para WordPress es vulnerable a acceso no autorizado de datos debido a una autorizaci\u00f3n incorrecta en la funci\u00f3n parse_custom_args() en todas las versiones hasta la 7.8.1, inclusive. Esto hace posible para atacantes no autenticados exponer los t\u00edtulos y extractos de publicaciones privadas, en borrador, pendientes, programadas y en la papelera."}], "id": "CVE-2025-15525", "lastModified": "2026-06-17T08:37:57.257", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-15525", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-02T17:57:20.787024Z", "version": "2.0.3"}}]}, "published": "2026-01-31T05:16:09.820", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/ajax-load-more/tags/7.8.1/core/classes/class-alm-queryargs.php#L500"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d01f4e67-a463-4973-97b1-41a64398686a?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T00:17:54.077387+00:00", "value": {"mitigation_remediation": ["Upgrade the Ajax Load More plugin to a version newer than 7.8.1 to apply the vendor patch that corrects the authorization check.", "If an immediate upgrade is not possible, temporarily disable the plugin or replace it with an alternative that does not expose private content.", "Continuously monitor access logs for anomalous requests targeting the plugin\u2019s query endpoints and implement rate limiting or API security measures to mitigate potential exploitation attempts."], "summary": {"action": "Patch", "impact": "Unauthorized Exposure of Private Post Titles and Excerpts"}, "threat_synthesis": {"affected_systems": "All installations of the dcooney Ajax Load More \u2013 Infinite Scroll, Load More, & Lazy Load plugin from its inception through version 7.8.1 are impacted. Users who have not upgraded beyond this release are susceptible to this data exposure risk.", "description_and_impact": "The Ajax Load More plugin for WordPress contains an incorrect authorization check in the parse_custom_args() function. This flaw allows an unauthenticated attacker to retrieve the titles and excerpts of private, draft, pending, scheduled, or trashed posts, exposing sensitive content that should remain hidden. The vulnerability is characterized by a CWE-863 weakness related to Designates Wrong Permission Assessment.", "risk_and_exploitability": "The CVSS base score of 5.3 indicates a moderate severity. With an EPSS score of less than 1%, the likelihood of active exploitation at the moment is low, and the vulnerability is not cataloged in CISA\u2019s KEV list. Based on the description, it is inferred that the most probable exploitation pathway involves an unauthenticated HTTP request to the plugin\u2019s endpoint that triggers the flawed authorization logic, enabling the attacker to read protected post metadata."}}}}, "created": "2026-02-02T09:26:43.280700+00:00", "updated": "2026-04-21T00:30:22.964352+00:00", "vendors": ["dcooney", "dcooney$PRODUCT$ajax_load_more_-_infinite_scroll,_load_more,_&_lazy_load", "wordpress", "wordpress$PRODUCT$wordpress"]}