CVE-2025-12577

MediumCVSS 4.3

Published: 06/12/2025(UTC)Updated: 15/10/2026(UTC)Translated: 16/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.19%

8th percentile - higher than 8% of all known CVEs

Summary

The Listar – Directory Listing & Classifieds WordPress Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the '/wp-json/listar/v1/place/save' REST API endpoint in all versions up to, and including, 3.0.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update listing details.

Risk Assessment

An attacker can modify data on the site, potentially leading to unauthorized content changes.

Recommendation

Update the Listar plugin to the latest version and implement capability checks on the REST API endpoint.

Other vulnerabilities in Listar – Directory Listing & Classifieds WordPress Plugin

CVE-2025-12574Medium
The Listar – Directory Listing & Classifieds WordPress Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the '/wp-json/listar/v1/place/delete' REST API endpoint in all versions up to, and including, 3.0.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary posts.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS