CVE-2026-27391
MediumCVSS 5.4Summary
The uListing plugin for WordPress versions 2.2.0 and earlier contains a broken access control vulnerability exploitable by a Subscriber-level user.
Risk Assessment
An attacker with low privileges can gain unauthorized access to functions or data they should not be able to access.
Recommendation
Update the uListing plugin to the latest available version.
Other vulnerabilities in uListing
See all- CVE-2026-62033High
Subscriber Settings Change in the uListing plugin up to version 2.2.0. A user can change subscription settings without proper permissions.
- CVE-2026-27392Medium
The uListing plugin for WordPress versions 2.2.0 and earlier contains a broken access control vulnerability exploitable by a Contributor-level user.
- CVE-2026-62031Critical
SQL Injection vulnerability in uListing versions up to and including 2.2.0. An unauthenticated attacker can inject malicious SQL queries, potentially leading to disclosure or modification of database data. The issue affects unauthenticated access.
Original NVD description (English source)
Subscriber Broken Access Control in uListing <= 2.2.0 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS