CVE-2021-4370
First published: Wed Jun 07 2023(Updated: )
The uListing plugin for WordPress is vulnerable to authorization bypass as most actions and endpoints are accessible to unauthenticated users, lack security nonces, and data is seldom validated. This issue exists in versions up to, and including, 1.6.6. This makes it possible for unauthenticated attackers to conduct numerous administrative actions, including those less critical than the explicitly outlined ones in our detection.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| StylemixThemes uListing | <=1.6.6 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://blog.nintechnet.com/wordpress-ulisting-plugin-fixed-multiple-critical-vulnerabilities/
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2456786%40ulisting&new=2456786%40ulisting&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/c5ada976-03b8-4219-9ae3-9060fb7b9de5?source=cve
Frequently Asked Questions
What is CVE-2021-4370?
CVE-2021-4370 is a vulnerability in the uListing plugin for WordPress that allows unauthorized access and lacks proper data validation.
How severe is CVE-2021-4370?
CVE-2021-4370 has a severity rating of 9.8, which is categorized as critical.
What software versions are affected by CVE-2021-4370?
Versions up to and including 1.6.6 of the uListing plugin for WordPress are affected by CVE-2021-4370.
How can an attacker exploit CVE-2021-4370?
An attacker can exploit CVE-2021-4370 by bypassing authorization and accessing actions and endpoints that should be restricted to authenticated users.
Is there a fix for CVE-2021-4370?
Yes, a fix for CVE-2021-4370 is available. It is recommended to update to the latest version of the uListing plugin for WordPress.
- agent/type
- agent/references
- agent/weakness
- agent/severity
- agent/remedy
- agent/author
- agent/softwarecombine
- agent/description
- agent/first-publish-date
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/stylemixthemes
- canonical/stylemixthemes ulisting
- version/stylemixthemes ulisting/1.6.6