List Category Posts WordPress Plugin Information Exposure Vulnerability

A vulnerability allowing information exposure has been identified in the List Category Posts plugin for WordPress, affecting all versions through 0.92.0. The issue arises from inadequate restrictions on which posts can be included via the 'catlist' shortcode. This flaw enables authenticated attackers with contributor-level access and above to access data from password-protected, private, or draft posts that should otherwise be restricted.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive information from posts that are password-protected, private, or in draft status.

Remediation

Users can update to version 0.93.0 or a newer patched version to address this vulnerability.