Skip to main content

Ulisting CVE-2021-36874

HIGH
Authorization Bypass Through User-Controlled Key (CWE-639)
2021-09-27 audit@patchstack.com
WordPress Authentication Bypass Ulisting
8.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
8.8 HIGH
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
Sep 27, 2021 - 16:15 nvd
HIGH 8.8

DescriptionNVD

Authenticated Insecure Direct Object References (IDOR) vulnerability in WordPress uListing plugin (versions <= 2.0.5).

AnalysisAI

Authenticated Insecure Direct Object References (IDOR) vulnerability in WordPress uListing plugin (versions <= 2.0.5). Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-639. Authenticated Insecure Direct Object References (IDOR) vulnerability in WordPress uListing plugin (versions <= 2.0.5). Affected products include: Stylemixthemes Ulisting.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Ulisting

View all
CVE-2021-4340 CRITICAL POC
9.8 Jun 07

The uListing plugin for WordPress is vulnerable to generic SQL Injection via the ‘listing_id’ parameter in versions up t
CVE-2021-4343 CRITICAL POC
9.8 Jun 07

The Unauthenticated Account Creation plugin for WordPress is vulnerable to Unauthenticated Account Creation in versions

CVE-2021-4346 CRITICAL POC
9.8 Jun 07

The uListing plugin for WordPress is vulnerable to Unauthenticated Arbitrary Account Changes in versions up to, and incl
CVE-2021-4381 CRITICAL POC
9.8 Jun 07

The uListing plugin for WordPress is vulnerable to authorization bypass via wp_route due to missing capability checks, a
CVE-2021-4370 CRITICAL POC
9.8 Jun 07

The uListing plugin for WordPress is vulnerable to authorization bypass as most actions and endpoints are accessible to

CVE-2021-4341 CRITICAL POC
9.8 Jun 07

The uListing plugin for WordPress is vulnerable to authorization bypass via Ajax due to missing capability checks, missi
CVE-2021-36879 CRITICAL POC
9.8 Sep 27

Unauthenticated Privilege Escalation vulnerability in WordPress uListing plugin (versions <= 2.0.5). Rated critical seve
CVE-2021-4357 CRITICAL POC
9.1 Jun 07

The uListing plugin for WordPress is vulnerable to authorization bypass due to missing capability checks, and a missing

CVE-2021-4339 HIGH POC
7.5 Jun 07

The uListing plugin for WordPress is vulnerable to authorization bypass due to a missing capability check in the "ulisti
CVE-2021-4345 MEDIUM POC
6.5 Jun 07

The uListing plugin for WordPress is vulnerable to authorization bypass due to missing capability and nonce checks on th
CVE-2021-36880 CRITICAL
9.8 Sep 27

Unauthenticated SQL Injection (SQLi) vulnerability in WordPress uListing plugin (versions <= 2.0.3), vulnerable paramete
CVE-2021-36876 HIGH
8.8 Sep 27

Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in WordPress uListing plugin (versions <= 2.0.5) as it lacks

Same weakness CWE-639 – Authorization Bypass Through User-Controlled Key

View all
CVE-2024-50483 CRITICAL
9.8
CVE-2026-55255 HIGH POC
8.4
CVE-2025-3605 CRITICAL POC
9.8
CVE-2022-3805 HIGH POC
8.6
CVE-2025-5947 CRITICAL POC
9.8
CVE-2020-36923 CRITICAL POC
9.8
CVE-2023-3048 CRITICAL POC
9.8
CVE-2024-27730 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2017-10271 HIGH POC
7.5
CVE-2015-1427 CRITICAL POC
9.8
CVE-2025-3248 CRITICAL POC
9.8

Share

CVE-2021-36874 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy