CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The Listar – Directory Listing & Classifieds WordPress Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the '/wp-json/listar/v1/place/delete' REST API endpoint in all versions up to, and including, 3.0.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary posts.
Explanation of Vulnerability in Simple Terms
The Listar Directory Listing & Classifieds WordPress plugin through version 3.0.0 lacks proper authorization checks on certain functions. A logged-in user with low privileges can modify data they should not have access to. The vulnerability requires an active WordPress account but no special permissions or user interaction from a victim.
What an attacker can do
Modify data in the plugin that should be restricted to higher-privilege users.
Potential impact on your site
Unauthorized users can alter plugin settings or content, potentially disrupting directory listings or classifieds functionality.
Conditions required to exploit
Attacker must have a low-privilege WordPress user account (e.g., subscriber or contributor role).
Key dates
External resources
