The List category posts plugin for WordPress contains an Information Exposure flaw. The vulnerability is tied to the 'catlist' shortcode, where the code fails to enforce proper visibility restrictions, allowing authenticated users with contributor or higher privileges to view posts that are password protected, private, or drafts. This flaw maps to CWE‑200 and lets attackers read content they should not see, potentially leaking confidential or unpublished information.

The flaw exists in all releases of the fernandobt List category posts plugin up to and including version 0.92.0. WordPress sites that have installed that plugin and have users with contributor-level access are susceptible.

The CVSS score of 4.3 indicates a moderate severity. The EPSS score of less than 1% signals that exploitation is unlikely at this time, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need to authenticate to the WordPress site with at least contributor permissions and then invoke the vulnerable catlist shortcode to enumerate and read posts that are normally hidden. The impact is confined to the data exposure of protected posts, not to code execution or denial of service.