CVE-2021-4357
First published: Wed Jun 07 2023(Updated: )
The uListing plugin for WordPress is vulnerable to authorization bypass due to missing capability checks, and a missing security nonce, on the UlistingUserRole::save_role_api function in versions up to, and including, 1.6.6. This makes it possible for unauthenticated attackers to arbitrarily delete site posts and pages.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Stylemixthemes Ulisting | <=1.6.6 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://blog.nintechnet.com/wordpress-ulisting-plugin-fixed-multiple-critical-vulnerabilities/
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2456786%40ulisting&new=2456786%40ulisting&sfp_email=&sfph_mail=
- https://wordpress.org/plugins/ulisting/#developers
- https://www.wordfence.com/threat-intel/vulnerabilities/id/71aa14b8-39bc-4b91-a7cf-9d203fdf44ea?source=cve
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2021-4357.
What is the title of the vulnerability?
The title of the vulnerability is 'The uListing plugin for WordPress is vulnerable to authorization bypass due to missing capability checks and a missing security nonce on the UlistingUserRole::save_role_api function in versions up to, and including, 1.6.6.'
What is the severity level of CVE-2021-4357?
The severity level of CVE-2021-4357 is critical with a severity value of 5.3.
How does CVE-2021-4357 affect the uListing plugin for WordPress?
CVE-2021-4357 affects the uListing plugin for WordPress in versions up to, and including, 1.6.6.
How can an attacker exploit this vulnerability?
An attacker can exploit this vulnerability by bypassing authorization and deleting arbitrary data.
- collector/nvd-index
- agent/weakness
- agent/event
- agent/references
- agent/severity
- agent/author
- agent/description
- agent/type
- agent/remedy
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/stylemixthemes
- canonical/stylemixthemes ulisting
- version/stylemixthemes ulisting/1.6.6