What is the CVSS score of CVE-2026-27392?

CVE-2026-27392 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

uListing CVE-2026-27392

EUVD-2026-48156 MEDIUM

Missing Authorization (CWE-862)

2026-07-23 Patchstack

GHSA-grfg-4mx7-gr2p

WordPress Authentication Bypass Ulisting Wordpress Plugin Stylemix

4.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Contributor role (PR:L) required; network-accessible WordPress endpoint with low complexity; only integrity is impacted via unauthorized listing modification.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 13:03 vuln.today

DescriptionCVE.org

Contributor Broken Access Control in uListing <= 2.2.0 versions.

AnalysisAI

Broken access control in the uListing WordPress plugin (versions <= 2.2.0) allows authenticated users holding the Contributor role to perform privileged actions beyond their authorization level, resulting in unauthorized data modification. The flaw stems from missing authorization checks (CWE-862), confirmed by Patchstack, with a CVSS 3.1 score of 4.3. No active exploitation has been identified, but the low attack complexity and network accessibility make this a realistic lateral-privilege risk on affected WordPress installations running the plugin.

Technical ContextAI

uListing is a WordPress listing directory plugin developed by StyleMix (CPE: cpe:2.3:a:stylemix:ulisting:*:*:*:*:*:*:*:*). The root cause is CWE-862 (Missing Authorization): specific plugin functionality fails to verify whether the currently authenticated WordPress user possesses sufficient capabilities before executing privileged operations. WordPress Contributor accounts are low-trust by design - they can submit but not publish content - so bypassing authorization checks at this role level allows privilege escalation within the application's data plane without compromising the broader WordPress installation scope.

RemediationAI

Update the uListing plugin to a version beyond 2.2.0 once a patched release is published by StyleMix - verify the current latest version in the WordPress plugin repository against the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/ulisting/vulnerability/wordpress-ulisting-plugin-2-2-0-broken-access-control-vulnerability. A vendor-released patch version has not been independently confirmed from the available data. As a compensating control until a patch is applied, restrict the ability for untrusted users to self-register or be assigned the Contributor role on affected WordPress installations; this eliminates the PR:L prerequisite and prevents unauthenticated or low-trust external attackers from reaching the vulnerable endpoint. Disabling open user registration (Settings > General > Anyone can register) is a low-risk mitigation with no impact on existing authenticated workflows.