CVE-2025-12010 is a medium severity vulnerability in the Authors List plugin for WordPress, affecting all versions up to 2.0.6.1. It allows authenticated users with Contributor or higher privileges to exploit an arbitrary method call in the Authors_List_Shortcode class. By manipulating shortcode attributes, attackers can invoke methods like get_meta to extract sensitive user data including password hashes, email addresses, usernames, and activation keys. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, and partial privileges required but no user interaction needed. No patch or vendor advisory is currently available to confirm remediation status.

An attacker with Contributor-level access or higher can extract sensitive user information such as password hashes, email addresses, usernames, and activation keys. This exposure could lead to further compromise of user accounts or site integrity. The vulnerability does not affect availability or integrity directly but poses a significant confidentiality risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access to trusted users only and monitor for suspicious shortcode usage. Avoid using the Authors List plugin if possible or disable it temporarily to prevent exploitation.