CVE-2026-12434 is a sensitive information exposure vulnerability in the List category posts plugin for WordPress, affecting all versions up to and including 0.95.0. The vulnerability arises from improper authorization checks related to the sanitize_status parameter, enabling authenticated users with contributor-level permissions or higher to extract detailed information from other users' posts in non-published states (pending-review, scheduled, trashed). This exploit involves embedding a specially crafted [catlist] shortcode in a draft post and previewing it, bypassing the incomplete fix applied in version 0.93.0 for CVE-2025-11377.

An attacker with contributor-level access or above can access sensitive information from other users' posts that are not publicly visible, including titles, full content, excerpts, dates, authors, and custom metadata. This exposure does not affect integrity or availability but compromises confidentiality of unpublished or non-public posts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch has been documented as of the published date. Until a patch is available, restrict contributor-level access and above to trusted users only and monitor plugin updates for a security release addressing this issue.