CVE-2025-1322: WP-Recall – Registration, Profile, Commerce & More <= 16.26.10 - Authenticated (Contributor+) Protected Post Disclosure
First published: Sat Mar 08 2025(Updated: )
The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 16.26.10 via the 'feed' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to view data from password protected, private, or draft posts that they should not have access to.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| WP-Recall Registration, Profile, Commerce & More | <=16.26.10 | |
| Plechev Andrey WP-Recall | <16.26.12 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-1322?
The severity of CVE-2025-1322 is rated as high due to the risk of information exposure.
How do I fix CVE-2025-1322?
To fix CVE-2025-1322, update the WP-Recall plugin to version 16.26.11 or later.
What types of information are exposed by CVE-2025-1322?
CVE-2025-1322 can expose sensitive post content that should be restricted, due to insufficient controls on the 'feed' shortcode.
Is CVE-2025-1322 present in older versions of the WP-Recall plugin?
Yes, CVE-2025-1322 affects all versions of the WP-Recall plugin up to and including 16.26.10.
What can attackers do with CVE-2025-1322?
Attackers can exploit CVE-2025-1322 to access unauthorized content from posts, leading to potential privacy violations.
- agent/references
- agent/title
- agent/type
- agent/first-publish-date
- agent/description
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/author
- agent/source
- agent/severity
- agent/event
- collector/mitre-cve
- source/MITRE
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- agent/weakness
- agent/softwarecombine
- agent/remedy
- agent/tags
- vendor/wp-recall
- canonical/wp-recall registration, profile, commerce & more
- vendor/plechevandrey
- canonical/plechev andrey wp-recall