uListing CVE-2026-27392

Exploitation requires an authenticated WordPress session with at least the Contributor role. The attacker must have network access to the WordPress installation's admin-ajax.php or REST API endpoint serviced by uListing. The plugin must be installed and active. Exploitation is limited by the need for a Contributor-level account - unauthenticated access is not possible per the CVSS PR:L metric. Sites that disable open user registration or restrict Contributor role assignment to trusted users are significantly less exposed. Scope is unchanged (S:U), meaning the vulnerability does not allow escape to the underlying server or other WordPress plugins.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) scores 4.3, reflecting a medium-low severity. Attack vector is network, complexity is low, and no user interaction is required, making exploitation straightforward for any attacker who obtains or registers a Contributor account on the target site. However, the scope is unchanged and confidentiality/availability are unaffected, limiting blast radius to integrity. No CISA KEV listing and no public exploit code have been identified at time of analysis. EPSS data is not provided. Real-world risk is meaningful primarily on multi-author WordPress sites where untrusted Contributor accounts exist or can be self-registered - a common configuration for community-driven listing directories, which is precisely this plugin's target deployment. The risk is lower on single-author or tightly controlled sites.

An attacker registers or is granted a Contributor account on a WordPress site running uListing <= 2.2.0. They then directly invoke a plugin endpoint or AJAX action that performs a privileged listing operation - such as publishing, editing, or deleting listings owned by others - without the authorization check blocking them. No public exploit code is known, but the low complexity of missing-authorization flaws means manual crafting of the request requires minimal effort.