CVE-2021-4339: uListing <= 1.6.6 - Unauthenticated Information Disclosure
The uListing plugin for WordPress is vulnerable to authorization bypass due to a missing capability check in the "ulisting/includes/route.php" file on the /1/api/ulisting-user/search REST-API route in versions up to, and including, 1.6.6. This makes it possible for unauthenticated attackers to retrieve the list of all users and their email address in the database.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this uListing WordPress plugin vulnerability?
The vulnerability ID for this uListing WordPress plugin vulnerability is CVE-2021-4339.
What is the severity level of CVE-2021-4339?
The severity level of CVE-2021-4339 is high.
How does CVE-2021-4339 affect the uListing plugin for WordPress?
CVE-2021-4339 allows unauthenticated attackers to retrieve sensitive information due to an authorization bypass vulnerability in the uListing plugin for WordPress.
What versions of the uListing plugin for WordPress are affected by CVE-2021-4339?
Versions up to and including 1.6.6 of the uListing plugin for WordPress are affected by CVE-2021-4339.
Is there a fix available for CVE-2021-4339?
Yes, a fix is available for CVE-2021-4339. It is recommended to update to a version of the uListing plugin for WordPress that is not affected by this vulnerability.