EUVD-2026-48155
GHSA-93hx-5hmm-39hh
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Subscriber-level authentication required (PR:L) over network (AV:N); no confidentiality impact; integrity and availability impact scoped to plugin data only (S:U).
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
1DescriptionCVE.org
Subscriber Broken Access Control in uListing <= 2.2.0 versions.
AnalysisAI
Broken access control in the uListing WordPress plugin (versions <= 2.2.0) by Stylemix permits subscriber-level authenticated users to invoke plugin functionality reserved for higher-privileged roles. The root cause (CWE-862, Missing Authorization) means the plugin does not enforce role checks before executing sensitive operations, allowing low-privilege accounts to impact integrity and availability of listing data. No public exploit code or active exploitation has been identified at the time of analysis.
Technical ContextAI
uListing is a WordPress directory and listing plugin developed by Stylemix (CPE: cpe:2.3:a:stylemix:ulisting:*:*:*:*:*:*:*:*). The underlying vulnerability class is CWE-862 (Missing Authorization), meaning the plugin fails to verify whether the requesting WordPress user holds sufficient privileges before executing restricted operations. In the WordPress role hierarchy, Subscriber is the lowest authenticated role - intended only for profile management and reading content. This flaw allows subscriber-level sessions to reach plugin endpoints or actions meant for editors, listing managers, or administrators, violating the principle of least privilege at the application layer rather than the WordPress core layer.
RemediationAI
Update the uListing plugin to a version released after 2.2.0 that resolves this broken access control; verify the exact patched release version via the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/ulisting/vulnerability/wordpress-ulisting-plugin-2-2-0-broken-access-control-vulnerability-2?_s_id=cve or the official WordPress plugin repository, as no specific fix version was confirmed in the available data. As a compensating control prior to patching, administrators should disable WordPress user self-registration (Settings > General > uncheck 'Anyone can register') on sites where public subscriber enrollment is not operationally required - this removes the primary account-acquisition path for unauthenticated attackers. Sites that must allow registration should audit existing subscriber accounts for suspicious activity and consider temporarily deactivating the uListing plugin until a patched version is applied.
The uListing plugin for WordPress is vulnerable to generic SQL Injection via the ‘listing_id’ parameter in versions up t
The Unauthenticated Account Creation plugin for WordPress is vulnerable to Unauthenticated Account Creation in versions
The uListing plugin for WordPress is vulnerable to Unauthenticated Arbitrary Account Changes in versions up to, and incl
The uListing plugin for WordPress is vulnerable to authorization bypass via wp_route due to missing capability checks, a
The uListing plugin for WordPress is vulnerable to authorization bypass as most actions and endpoints are accessible to
The uListing plugin for WordPress is vulnerable to authorization bypass via Ajax due to missing capability checks, missi
Unauthenticated Privilege Escalation vulnerability in WordPress uListing plugin (versions <= 2.0.5). Rated critical seve
The uListing plugin for WordPress is vulnerable to authorization bypass due to missing capability checks, and a missing
The uListing plugin for WordPress is vulnerable to authorization bypass due to a missing capability check in the "ulisti
The uListing plugin for WordPress is vulnerable to authorization bypass due to missing capability and nonce checks on th
Unauthenticated SQL Injection (SQLi) vulnerability in WordPress uListing plugin (versions <= 2.0.3), vulnerable paramete
The Directory Listings WordPress plugin - uListing plugin for WordPress is vulnerable to unauthorized modification of da
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today