The vulnerability arises from a missing capability check on the /wp-json/listar/v1/place/save REST API endpoint in the Listar – Directory Listing & Classifieds WordPress Plugin. This flaw allows an authenticated user with Subscriber-level access or higher to modify listing details, compromising data integrity. The issue is a classic missing authorization weakness (CWE-862).

WordPress sites that use the Listar – Directory Listing & Classifieds WordPress Plugin (vendor passionui) and run any version up to and including 3.0.0 are impacted. No information is available regarding the status of newer releases.

Any authenticated user can exploit the endpoint to alter listings, as the missing capability check removes required authorization. Based on the description, the likely attack vector is internal, requiring the attacker to have a valid authenticated session. The CVSS score of 4.3 indicates moderate severity, and the EPSS score of less than 1% signals a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting no known active exploitation, but authorized users could still use the endpoint to persist unauthorized changes without additional privileges.