CVE-2026-27392
MediumCVSS 4.3Summary
The uListing plugin for WordPress versions 2.2.0 and earlier contains a broken access control vulnerability exploitable by a Contributor-level user.
Risk Assessment
An attacker with low privileges can gain unauthorized access to functions or data they should not be able to access.
Recommendation
Update the uListing plugin to the latest available version.
Other vulnerabilities in uListing
See all- CVE-2026-62033High
Subscriber Settings Change in the uListing plugin up to version 2.2.0. A user can change subscription settings without proper permissions.
- CVE-2026-27391Medium
The uListing plugin for WordPress versions 2.2.0 and earlier contains a broken access control vulnerability exploitable by a Subscriber-level user.
- CVE-2026-62031Critical
SQL Injection vulnerability in uListing versions up to and including 2.2.0. An unauthenticated attacker can inject malicious SQL queries, potentially leading to disclosure or modification of database data. The issue affects unauthenticated access.
Original NVD description (English source)
Contributor Broken Access Control in uListing <= 2.2.0 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS