The Page-list plugin for WordPress suffers from a missing authorization flaw that allows authenticated users with contributor or higher roles to inject attacker‑controlled attributes into the [pagelist_ext] and [pagelistext] shortcodes. Because the shortcode handler passes those attributes directly to the core page‑retrieval and metadata functions, the plugin renders titles, content or excerpts and arbitrary post meta from any page that matches the supplied criteria. The flaw has no user‑level capability check, enabling a contributor to reveal private or draft pages of other authors when they insert and preview the shortcode in a draft.

The vulnerability affects every installation of the Page‑list plugin for WordPress whose version is 6.2 or earlier. The plugin is distributed via the WordPress Plugin Repository under the name Page‑list. All core WordPress sites that allow contributors to edit content and embed shortcodes are impacted.

The CVSS score of 4.3 indicates a medium severity under the current scoring schema, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. The attack surface requires that the user has contributor or higher privileges and the ability to edit or preview a draft post. Once those conditions are met, the attacker can observe sensitive page content and metadata, effectively compromising confidentiality across the site.