CVE-2021-4346: uListing <= 1.6.6 - Unauthenticated Arbitrary Account Changes

Q: What is the vulnerability ID?

The vulnerability ID is CVE-2021-4346.

Q: What is the severity of CVE-2021-4346?

The severity of CVE-2021-4346 is critical with a CVSS score of 7.5.

Q: What is affected by CVE-2021-4346?

The uListing plugin for WordPress versions up to and including 1.6.6 is affected by CVE-2021-4346.

Q: How can an attacker exploit CVE-2021-4346?

Unauthenticated attackers can exploit CVE-2021-4346 by editing any account on the affected blog.

Q: Are there any fixes or patches available for CVE-2021-4346?

Yes, a fix is available for CVE-2021-4346. It is recommended to update the uListing plugin for WordPress to the latest version.

Published Jun 7, 2023

Updated

The uListing plugin for WordPress is vulnerable to Unauthenticated Arbitrary Account Changes in versions up to, and including, 1.6.6. This is due to missing login checks on the stmlistingprofileedit AJAX action. This makes it possible for unauthenticated attackers to edit any account on the blog, such as changing the admin account's email address.

Affected Software

1 affected component

StylemixThemes Ulisting Wordpress<=1.6.6

Remediation

Patch Available

https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2456786%40ulisting&new=2456786%40ulisting&sfp_email=&sfph_mail=

Event History

Jun 7, 2023

CVE Published

via MITRE·01:51 AM

Data Sourced

via MITRE·01:51 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·02:15 AM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the vulnerability ID?

The vulnerability ID is CVE-2021-4346.

What is the severity of CVE-2021-4346?

The severity of CVE-2021-4346 is critical with a CVSS score of 7.5.

What is affected by CVE-2021-4346?