CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
The ListingPro - WordPress Directory & Listing Theme for WordPress is vulnerable to Arbitrary Plugin Installation, Activation and Deactivation in versions before 2.6.1. This is due to a missing capability check on the lp_cc_addons_actions function. This makes it possible for unauthenticated attackers to arbitrarily install, activate and deactivate any plugin.
Explanation of Vulnerability in Simple Terms
ListingPro WordPress theme versions before 2.6.1 lack proper authorization checks on sensitive functions. An unauthenticated attacker can read, modify, or delete listings and user data without permission. This affects all sites running the vulnerable theme regardless of WordPress security settings. Update to version 2.6.1 or later immediately.
What an attacker can do
Read, modify, or delete listings and user data without logging in.
Potential impact on your site
Attackers can compromise all listings, user accounts, and site data without any credentials.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
