CVE-2026-9008

The Page-list plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 6.2. This is due to the pagelist_unqprfx_ext_shortcode() function (the [pagelist_ext] / [pagelistext] shortcode) accepting attacker-controlled post_status, post_type, and show_meta_key attributes and passing them directly into get_pages() and get_post_meta() with no capability check verifying that the rendering user is permitted to read the matched objects. When the current post has no child pages, the shortcode re-issues the query with child_of => 0, broadening it to every page on the site matching the supplied status/type. This makes it possible for authenticated attackers, with contributor-level access and above, to disclose the titles, body content/excerpts, and arbitrary post meta of unrelated private and draft pages by inserting the shortcode into a contributor-authored draft and previewing it.

• CWE-862

• https://plugins.trac.wordpress.org/browser/page-list/tags/5.9/page-list.php#L188
• https://plugins.trac.wordpress.org/browser/page-list/tags/5.9/page-list.php#L301
• https://plugins.trac.wordpress.org/browser/page-list/tags/5.9/page-list.php#L303
• https://plugins.trac.wordpress.org/browser/page-list/tags/5.9/page-list.php#L383
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3552931%40page-list&new=3552931%40page-list&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/22defe19-28ac-43b3-814d-5a2038380adb?source=cve

Published

Jun 6, 2026

Last Modified

Jul 23, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-8996The Backup and Staging by WP Time Capsule plugin for WordPre…6.5
• CVE-2026-8997vifm is vulnerable to a heap buffer overflow during the hist…4.8
• CVE-2026-9002IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 could al…6.5
• CVE-2026-9003E-LAN Hybrid Recording System developed by TONNET has a SQL …8.7
• CVE-2026-9006IBM WebSphere Application Server 9.0, and 8.5 is vulnerable …9.1
• CVE-2026-9007Improper neutralization of input during web page generation …5.5
• CVE-2026-9009The Crawlomatic Multipage Scraper Post Generator plugin for …8.8
• CVE-2026-9010The Boost plugin for WordPress is vulnerable to time-based S…7.5
• CVE-2026-9011The Ditty – Responsive News Tickers, Sliders, and Lists plug…7.5
• CVE-2026-9013The Bogo plugin for WordPress is vulnerable to Sensitive Inf…4.3
• CVE-2026-9014The WP Promoter plugin for WordPress is vulnerable to unauth…5.3
• CVE-2026-9015The Equalize Digital Accessibility Checker – WCAG, ADA, EAA …4.3