CVE-2025-12010
Authors List <= 2.0.6.1 - Authenticated (Contributor+) Sensitive Information Exposure via Limited Method Call in Plugin's Shortcode
CVSS Score
6.5
EPSS Score
0.0%
EPSS Percentile
0th
The Authors List plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.0.6.1 via the via arbitrary method call from Authors_List_Shortcode class. This makes it possible for authenticated attackers, with Contributor-level access and above, to call methods such as get_meta to extract sensitive user data including password hashes, email addresses, usernames, and activation keys via specially crafted shortcode attributes
| CWE | CWE-200 |
| Vendor | wpkube |
| Product | authors list |
| Published | Nov 11, 2025 |
| Last Updated | Apr 8, 2026 |
Stay Ahead of the Next One
Get instant alerts for wpkube authors list
Be the first to know when new medium vulnerabilities affecting wpkube authors list are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
wpkube / Authors List
0 ≤ 2.0.6.1
References
wordfence.com: https://www.wordfence.com/threat-intel/vulnerabilities/id/5189c1c0-2d4c-47f5-b8d9-3192a670e586?source=cve plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/authors-list/tags/2.0.6.1/includes/class-authors-list-shortcode.php#L868 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/authors-list/tags/2.0.6.1/includes/class-authors-list-shortcode.php#L852 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/authors-list/tags/2.0.6.2/includes/class-authors-list-shortcode.php#L868
Credits
kai