uListing CVE-2026-62033

Requires an authenticated account at WordPress subscriber level (the lowest standard role) on a site running uListing version 2.2.0 or earlier; exploitation targets a settings-change function that lacks a proper authorization/capability check. The limiting factor is that the attacker must first obtain a subscriber account - trivial on sites with open user registration enabled, but a real barrier on sites that disable self-registration. No higher privileges, no user interaction, and no special non-default configuration beyond having the vulnerable plugin active are needed.

This is a moderate-priority issue rather than an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L, score 7.6) describes a network-reachable, low-complexity flaw requiring only low privileges (PR:L) and no user interaction - consistent with CWE-862 (Missing Authorization), where an authenticated low-privilege user (subscriber) performs actions reserved for higher roles. No EPSS score, CISA KEV listing, or public POC was provided in the input, so exploitation probability cannot be quantified and there is no evidence of active exploitation; the current status is 'no public exploit identified at time of analysis.' Two signals are in tension and should be verified: the vendor-assigned C:H (high confidentiality impact) is difficult to reconcile with a vulnerability described merely as 'Subscriber Settings Change,' which is primarily an integrity concern - the high confidentiality rating may be inflated and should be confirmed with Patchstack. Also note the 'Authentication Bypass' tag conflicts with the actual nature of the flaw: PR:L and CWE-862 indicate the attacker is already authenticated and is bypassing authorization, not authentication. Overall real-world risk is tempered by the requirement for an existing subscriber account on the target site.

An attacker registers for (or already holds) a low-privilege subscriber account on a WordPress site running uListing 2.2.0 or earlier. Because the plugin fails to verify authorization on a settings endpoint, the attacker sends a crafted authenticated request to change plugin settings they should not control. No public exploit code was identified at the time of analysis, and the low attack complexity (AC:L) means success is reliable once a subscriber account exists.