CVE-2021-4381
First published: Wed Jun 07 2023(Updated: )
The uListing plugin for WordPress is vulnerable to authorization bypass via wp_route due to missing capability checks, and a missing security nonce, in the StmListingSingleLayout::import_new_layout method in versions up to, and including, 1.6.6. This makes it possible for unauthenticated attackers to change any WordPress option in the database.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| StylemixThemes uListing | <1.7 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://blog.nintechnet.com/wordpress-ulisting-plugin-fixed-multiple-critical-vulnerabilities/
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2456786%40ulisting&new=2456786%40ulisting&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/ff5755dc-2262-47f6-ac3a-6bca9529d088?source=cve
Frequently Asked Questions
What is CVE-2021-4381?
CVE-2021-4381 is a vulnerability in the uListing plugin for WordPress that allows for authorization bypass and potential attacks by unauthenticated users.
How severe is CVE-2021-4381?
CVE-2021-4381 is classified as critical with a severity score of 9.8.
How does CVE-2021-4381 affect the uListing plugin for WordPress?
CVE-2021-4381 affects versions up to and including 1.6.6 of the uListing plugin for WordPress.
What is the impact of CVE-2021-4381?
CVE-2021-4381 allows unauthenticated attackers to bypass authorization and potentially perform malicious actions on affected WordPress sites.
How can I mitigate the vulnerability in the uListing plugin for WordPress?
To mitigate the vulnerability in the uListing plugin for WordPress, it is recommended to update to version 1.7 or later of the plugin.
- agent/type
- agent/softwarecombine
- agent/references
- agent/weakness
- agent/author
- agent/remedy
- agent/severity
- agent/description
- agent/first-publish-date
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/stylemixthemes
- canonical/stylemixthemes ulisting