What is the CVSS score of CVE-2026-65478?

CVE-2026-65478 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

ListingPro CVE-2026-65478

EUVD-2026-48089 MEDIUM

Missing Authorization (CWE-862)

2026-07-23 Patchstack

GHSA-v4qh-q9q7-ccm2

WordPress Authentication Bypass Listingpro Wordpress Plugin

5.4

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

Network-reachable WordPress plugin endpoint; PR:L because a subscriber account is required; partial C and I impact from unauthorized data access and modification; no availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 13:23 vuln.today

CVE Published

Jul 23, 2026 - 11:18 cve.org

MEDIUM 5.4

DescriptionCVE.org

Subscriber Broken Access Control in ListingPro <= 2.9.10 versions.

AnalysisAI

Broken Access Control in the ListingPro WordPress plugin (versions up to and including 2.9.10) allows authenticated subscriber-level users to perform actions or access resources restricted to higher-privileged roles. The CVSS vector (PR:L/AV:N/AC:L) confirms network-reachable exploitation by any user holding a low-privilege WordPress account, with partial confidentiality and integrity impact. No public exploit code or CISA KEV listing has been identified at time of analysis, placing this in the category of a real but moderately constrained risk.

Technical ContextAI

ListingPro is a commercial directory-listing WordPress plugin developed by Crudio Studio, identified by CPE cpe:2.3:a:cridiostudio:listingpro:*:*:*:*:*:*:*:*. The root cause is CWE-862 (Missing Authorization), a class of vulnerability where the application fails to verify that the authenticated user possesses sufficient privileges before executing a sensitive action or returning restricted data. In the WordPress ecosystem, subscriber is the lowest default user role, typically granted upon open registration. A Missing Authorization flaw at this role means any registered user - not just editors, authors, or administrators - can invoke plugin functionality gated behind what should be a privileged check, bypassing the access control layer entirely without needing to escalate privileges.

RemediationAI

Update ListingPro to a version beyond 2.9.10 by applying the latest release available from the plugin vendor or the WordPress plugin repository. Note that no exact patched version number is confirmed in the currently available data; consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/listingpro-plugin/vulnerability/wordpress-listingpro-plugin-2-9-10-broken-access-control-vulnerability for the specific fixed release once confirmed. If an immediate update is not possible, the most effective compensating control is to disable open user registration on the WordPress site (Settings > General > uncheck 'Anyone can register'), which prevents unauthenticated attackers from obtaining the subscriber account required for exploitation. Sites that require open registration should consider adding a Web Application Firewall rule targeting the vulnerable ListingPro endpoints identified in the Patchstack report. Disabling registration may impact site functionality for directory submission workflows that rely on subscriber accounts.