The Authors List plugin for WordPress allows an authenticated attacker with Contributor or higher privileges to craft a shortcode that invokes a private method of the Authors_List_Shortcode class. This method call can retrieve sensitive user information, including password hashes, email addresses, usernames, and activation keys. The flaw is a classic Sensitive Data Exposure bug (CWE‑200) that does not compromise the system itself but leaking information that could be used for credential stuffing or further exploitation.

WordPress sites that use the Authors List plugin, targeting any release up to and including version 2.0.6.1. Versions prior to 2.0.6.2 are affected; 2.0.6.2 and later include the fix.

The CVSS score of 6.5 reflects a moderate severity. The EPSS score is below 1%, indicating a very low but non‑zero probability of exploitation in the wild, and the vulnerability is not yet listed in CISA’s KEV catalog. An attacker must be authenticated with Contributor or higher permissions, craft a malicious shortcode payload, and embed it in a post or page to trigger the vulnerable method. Once executed, the attacker can harvest private user metadata.