Authorization Bypass Vulnerability in uListing Plugin for WordPress

CVE-2021-4370

Summary

The uListing plugin for WordPress contains a vulnerability that allows unauthorized users to bypass access controls, gaining entry to numerous actions and endpoints without proper authentication. Key security measures, such as security nonces and data validation, are either insufficient or absent, creating opportunities for attackers to manipulate the plugin and perform actions typically reserved for authenticated users. This issue exists in versions up to and including 1.6.6, potentially exposing sites to various administrative controls and data manipulation risks.

References