Unauthorized Data Deletion in Listar WordPress Plugin by Listar

CVE-2025-12574

What is CVE-2025-12574?

The Listar – Directory Listing & Classifieds WordPress Plugin is prone to a security issue that permits unauthorized deletion of posts due to a lack of essential capability checks on its REST API endpoint. This vulnerability affects all versions up to and including 3.0.0, allowing authenticated attackers with Subscriber-level access or higher to delete arbitrary data, posing a significant risk to website integrity and content security.

References