Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.8

uListing plugin can let subscriber accounts become administrators

CVE-2025-1653 · published 1 year ago
Summary

The uListing plugin for WordPress versions up to 2.2.0 does not limit who can change a certain profile setting. Because of this, any user who can log in with a low‑level role (such as Subscriber) could raise their account to full administrator level. Install the latest version of the plugin or disable it until it is updated.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
stylemixthemes ulisting <= 2.1.7
cpe:2.3:a:stylemixthemes:ulisting:*:*:*:*:*:wordpress:*:*
Original advisory text
The Directory Listings WordPress plugin – uListing plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.2.0. This is due to the stm_listing_profile_edi...
The Directory Listings WordPress plugin – uListing plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.2.0. This is due to the stm_listing_profile_edit AJAX action not having enough restriction on the user meta that can be updated. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to that of an administrator.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
8.8 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-266Incorrect Privilege Assignment
Timeline
Published15 Mar 2025
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2025-1653 · NVD
Track software like this
Free during beta