CVE-2021-4339
First published: Wed Jun 07 2023(Updated: )
The uListing plugin for WordPress is vulnerable to authorization bypass due to a missing capability check in the "ulisting/includes/route.php" file on the /1/api/ulisting-user/search REST-API route in versions up to, and including, 1.6.6. This makes it possible for unauthenticated attackers to retrieve the list of all users and their email address in the database.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Stylemixthemes Ulisting | <=1.6.6 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://blog.nintechnet.com/wordpress-ulisting-plugin-fixed-multiple-critical-vulnerabilities/
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2456786%40ulisting&new=2456786%40ulisting&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/0a6615fd-7c37-45d9-a657-0ba00df840e5?source=cve
Frequently Asked Questions
What is the vulnerability ID for this uListing WordPress plugin vulnerability?
The vulnerability ID for this uListing WordPress plugin vulnerability is CVE-2021-4339.
What is the severity level of CVE-2021-4339?
The severity level of CVE-2021-4339 is high.
How does CVE-2021-4339 affect the uListing plugin for WordPress?
CVE-2021-4339 allows unauthenticated attackers to retrieve sensitive information due to an authorization bypass vulnerability in the uListing plugin for WordPress.
What versions of the uListing plugin for WordPress are affected by CVE-2021-4339?
Versions up to and including 1.6.6 of the uListing plugin for WordPress are affected by CVE-2021-4339.
Is there a fix available for CVE-2021-4339?
Yes, a fix is available for CVE-2021-4339. It is recommended to update to a version of the uListing plugin for WordPress that is not affected by this vulnerability.
- collector/nvd-index
- agent/severity
- agent/weakness
- agent/references
- agent/author
- agent/description
- agent/type
- agent/event
- agent/softwarecombine
- agent/first-publish-date
- agent/last-modified-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/stylemixthemes
- canonical/stylemixthemes ulisting
- version/stylemixthemes ulisting/1.6.6