CVE-2021-4341: uListing <= 1.6.6 - Unauthenticated Wordpress Options Changes via AJAX
The uListing plugin for WordPress is vulnerable to authorization bypass via Ajax due to missing capability checks, missing input validation, and a missing security nonce in the stmupdateemaildata AJAX action in versions up to, and including, 1.6.6. This makes it possible for unauthenticated attackers to change any WordPress option in the database.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for the uListing plugin for WordPress?
The vulnerability ID for the uListing plugin for WordPress is CVE-2021-4341.
What is the severity rating of CVE-2021-4341?
CVE-2021-4341 has a severity rating of 9.8 (Critical).
What is the affected software for CVE-2021-4341?
The affected software for CVE-2021-4341 is the uListing plugin for WordPress up to and including version 1.6.6.
What is the description of CVE-2021-4341?
CVE-2021-4341 is an authorization bypass vulnerability in the uListing plugin for WordPress due to missing capability checks, input validation, and security nonce.
How can I fix CVE-2021-4341 vulnerability?
To fix the CVE-2021-4341 vulnerability, make sure to update the uListing plugin for WordPress to a version higher than 1.6.6 and apply any available patches or security fixes.