EUVD-2025-209219
GHSA-wf7g-5h8x-jvpp
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Lifecycle Timeline
3Tags
Description
The Listeo Core plugin for WordPress is vulnerable to unauthenticated arbitrary media upload in all versions up to, and including, 2.0.27 via the "listeo_core_handle_dropped_media" function. This is due to missing authorization and capability checks on the AJAX endpoint handling file uploads. This makes it possible for unauthenticated attackers to upload arbitrary media to the site's media library, without achieving direct code execution.
Analysis
Unauthenticated arbitrary media upload in Listeo Core plugin for WordPress (versions up to 2.0.27) allows remote attackers to upload arbitrary files to the site's media library via the unprotected listeo_core_handle_dropped_media AJAX endpoint. The vulnerability stems from missing authorization checks and does not directly enable code execution, but significantly degrades site integrity by enabling malicious file storage and potential downstream attacks.
Technical Context
The vulnerability exists in the Listeo Core WordPress plugin, a directory listing theme/plugin developed by PureThemes. The affected AJAX endpoint listeo_core_handle_dropped_media processes file uploads without validating user capabilities or permissions. WordPress AJAX endpoints that lack proper nonce verification and capability checks (wp_verify_nonce and current_user_can) can be invoked by any unauthenticated visitor. The vulnerability falls under CWE-434 (Unrestricted Upload of File with Dangerous Type), a classic file upload authorization flaw. The CPE identifies the vulnerable product as purethemes:listeo-core_-_directory_plugin_by_purethemes across all versions through 2.0.27.
Affected Products
The Listeo Core plugin (purethemes:listeo-core_-_directory_plugin_by_purethemes) for WordPress is vulnerable in all versions up to and including 2.0.27. The vulnerability affects any WordPress site running an affected version of this directory listing plugin. Additional details and change history are available in the PureThemes knowledge base at https://docs.purethemes.net/listeo/knowledge-base/changelog-listeo/.
Remediation
Site administrators must immediately upgrade the Listeo Core plugin to a patched version released after 2.0.27. The exact patched version number is not specified in the available references; administrators should check the PureThemes changelog and plugin repository for the latest stable release. Updates can be applied via the WordPress admin dashboard (Plugins > Installed Plugins > Listeo Core > Update if available). As a temporary workaround pending patching, site administrators may disable the plugin entirely or restrict AJAX request handling via Web Application Firewall (WAF) rules targeting the listeo_core_handle_dropped_media endpoint, though this may impact legitimate functionality. Administrators should also audit their media library for suspicious uploads made during the window of exposure. Detailed guidance is available from Wordfence at https://www.wordfence.com/threat-intel/vulnerabilities/id/4decf597-1819-402f-ab28-2446a3e6215f.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today