CVE-2026-9008 is a missing authorization vulnerability in the webvitaly Page-list WordPress plugin (versions up to and including 6.2). The vulnerability arises because the pagelist_unqprfx_ext_shortcode() function accepts attacker-controlled attributes (post_status, post_type, show_meta_key) and passes them directly to get_pages() and get_post_meta() without checking if the user has permission to read the queried pages. If the current post has no child pages, the shortcode broadens the query to all pages matching the supplied parameters, enabling authenticated contributors or higher to disclose private and draft page data by inserting the shortcode into a draft post and previewing it.

An attacker with contributor-level or higher WordPress access can disclose sensitive information from private and draft pages, including titles, body content or excerpts, and arbitrary post metadata. This unauthorized data disclosure does not affect integrity or availability but compromises confidentiality of restricted content.

No official patch or remediation is currently available. Users should monitor the vendor advisory for updates. Until a fix is released, restrict contributor-level access carefully and avoid using the vulnerable shortcode in draft posts. Consider disabling or removing the Page-list plugin if sensitive data exposure risk is unacceptable.