The List Category Posts plugin contains a time‑based SQL Injection flaw in the starting_with parameter of the catlist shortcode. Insufficient input escaping and lack of prepared statements allow an authenticated contributor or higher to append arbitrary SQL to existing queries, enabling extraction of sensitive database contents. This weakness is formally categorized as CWE‑89, indicating a classic SQL injection risk that can compromise confidentiality by leaking user data, site configuration, and content.

WordPress sites that are running the List Category Posts plugin with a version of 0.91.0 or earlier are affected. The plugin is maintained by the author fernanobt and is deployed via the WordPress Plugins repository. Any site that has granted Contributor‑level access to users and has the unpatched plugin version installed is at risk.

The CVSS score of 6.5 signals substantial impact, yet the EPSS score of < 1% indicates a very low current likelihood that attackers will exploit this flaw. The vulnerability is not listed in the CISA KEV catalog. Attackers must first authenticate with at least Contributor privileges and then supply a crafted starting_with value through the catlist shortcode. No publicly available exploit code has been documented, but the existence of the flaw means that any Contributor on the site could potentially leak data if the plugin remains unpatched.