The Listar – Directory Listing & Classifieds WordPress Plugin suffers from a missing capability check on the "/wp-json/listar/v1/place/delete" REST API endpoint. An authenticated user with a Subscriber role or higher can invoke this endpoint to delete any post. This vulnerability represents a CWE-862: Missing Authorization. Consequently, data loss and site content tampering may occur, affecting the integrity and availability of user‑generated listings.

The vulnerability affects the Listar plugin, made by passionui, in all releases up to and including version 3.0.0. The plugin is commonly integrated into WordPress sites that rely on it for directory listing and classifieds functionality.

The CVSS base score of 4.3 classifies the threat as low severity, reflecting that an attacker must first gain authenticated access with at least Subscriber privileges. The EPSS score being less than 1% indicates that discovery of exploit code in the wild is unlikely. The vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation currently. Exploitation requires sending an authenticated request to the public REST endpoint; the attacker needs no special network position but must be able to authenticate. No elevated privileges beyond Subscriber are required, so the impact remains constrained to data deletion rather than broader system compromise.