CVE-2025-15525: 
WordPress vulnerability analysis and mitigation

CVE-2025-15525 is an incorrect authorization vulnerability in the Ajax Load More – Infinite Scroll, Load More, & Lazy Load plugin for WordPress. Due to improper authorization checks in the parse_custom_args() function, unauthenticated attackers can access the titles and excerpts of private, draft, pending, scheduled, and trashed posts. All plugin versions up to and including 7.8.1 are affected. The vulnerability was published on January 31, 2026, and carries a CVSS v3.1 base score of 5.3 (Medium) (Wordfence, Red Hat CVE).

The root cause is classified as CWE-863 (Incorrect Authorization): the parse_custom_args() function in class-alm-queryargs.php does not enforce proper access controls before returning post metadata, allowing any unauthenticated HTTP request to retrieve restricted content. The attack vector is network-accessible, requires no authentication, no user interaction, and low attack complexity — making it trivially exploitable by any remote attacker. The vulnerable code path can be reviewed in the plugin's source at the tagged release (WordPress Trac).

Successful exploitation results in unauthorized disclosure of post metadata — specifically titles and excerpts — for content in private, draft, pending, scheduled, or trashed states. While integrity and availability are not affected, the confidentiality breach can expose sensitive or embargoed content (e.g., unpublished articles, internal drafts) to any unauthenticated internet user. The scope is limited to the WordPress site's post metadata and does not enable code execution or lateral movement (Wordfence).

No public proof-of-concept exploit code or active in-the-wild exploitation has been reported for this vulnerability. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.047%, indicating a low probability of exploitation in the near term. The vulnerability is unauthenticated and network-accessible, which lowers the barrier for opportunistic exploitation, but the limited impact (metadata disclosure only) reduces attacker incentive (Wordfence).

1. Reconnaissance: Identify WordPress sites using the Ajax Load More plugin (versions ≤ 7.8.1) via passive scanning tools (e.g., WPScan, Shodan) or by detecting the plugin's front-end JavaScript assets.
2. Craft malicious request: Send an unauthenticated HTTP request to the WordPress site that invokes the Ajax Load More AJAX endpoint (typically wp-admin/admin-ajax.php) with parameters that trigger the parse_custom_args() function.
3. Bypass authorization: Because parse_custom_args() does not enforce post-status access controls, supply query arguments requesting posts with statuses such as private, draft, pending, future, or trash.
4. Retrieve restricted metadata: The server responds with post titles and excerpts for the requested non-public posts, exposing content that should be inaccessible to unauthenticated users (Wordfence, WordPress Trac).

• Network: Unusual or repeated unauthenticated POST requests to wp-admin/admin-ajax.php with Ajax Load More action parameters and post-status values of private, draft, pending, future, or trash.
• Logs: WordPress access logs showing high-frequency requests to the AJAX endpoint from a single IP or user-agent without a valid session cookie; responses returning post metadata for non-public content.
• Application: Unexpected exposure of draft or private post titles in server responses to unauthenticated clients.

Update the Ajax Load More plugin to version 7.8.2 or later, which contains the fix for the incorrect authorization in parse_custom_args(). No configuration-based workaround is available; upgrading is the only reliable remediation. Site administrators should audit recent access logs for suspicious AJAX requests targeting non-public post statuses as a precautionary measure (Wordfence, Wordfence Weekly Report).

Wordfence disclosed the vulnerability as part of its weekly WordPress vulnerability report for January 26–February 1, 2026, noting the authorization bypass and the availability of a patch in version 7.8.2 (Wordfence Weekly Report). No significant broader media coverage or notable researcher commentary beyond the initial disclosure has been identified.