CVE-2025-12010CWE-200information-disclosure

CVE-2025-12010

Medium · published November 11, 2025

CVSS v3.1
6.5
EPSS
0%
Percentile
34.2
In the wild
Unconfirmed
What it is

The Authors List plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.0.6.1 via the via arbitrary method call from Authors_List_Shortcode class. This makes it possible for authenticated attackers, with Contributor-level access and above, to call methods such as get_meta to extract sensitive user data including password hashes, email addresses, usernames, and activation keys via specially crafted shortcode attributes

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00410 · 34.2th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2025-11-11T09:15Z
References (4)
https://plugins.trac.wordpress.org/browser/authors-list/tags/2.0.6.1/includes/class-authors-list-shortcode.php#L852 · [email protected]https://plugins.trac.wordpress.org/browser/authors-list/tags/2.0.6.1/includes/class-authors-list-shortcode.php#L868 · [email protected]https://plugins.trac.wordpress.org/browser/authors-list/tags/2.0.6.2/includes/class-authors-list-shortcode.php#L868 · [email protected]https://www.wordfence.com/threat-intel/vulnerabilities/id/5189c1c0-2d4c-47f5-b8d9-3192a670e586?source=cve · [email protected]
EPSS history
Timeline
  • 11 NOV 03:30Z
    Authors List <= 2.0.6.1 - Authenticated (Contributor+) Sensitive Information Exposure via Limited Method Call in Plugin's Shortcode
    cvelistv5