The Page-list plugin for WordPress suffers from a missing authorization vulnerability (CWE-862) in all versions up to 6.2. The vulnerability arises in the pagelist_unqprfx_ext_shortcode() function, which processes the [pagelist_ext] and [pagelistext] shortcodes. These shortcodes accept attacker-controlled attributes such as post_status, post_type, and show_meta_key, which are passed directly to get_pages() and get_post_meta() without capability checks. When the current post has no child pages, the query broadens to include all pages matching the supplied parameters, enabling authenticated users with contributor-level access or higher to disclose titles, content excerpts, and arbitrary post meta of unrelated private and draft pages by previewing a draft containing the shortcode.

Authenticated users with contributor-level permissions or higher can bypass intended access controls to view titles, body content, excerpts, and arbitrary metadata of private and draft pages they do not own. This leads to unauthorized information disclosure but does not affect integrity or availability. The CVSS score is 4.3 (medium severity), reflecting the limited scope of impact to confidentiality only and requiring authenticated access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level user capabilities if possible or avoid using the vulnerable shortcode in draft posts. Monitor vendor channels for updates and apply patches promptly once released.