A flaw in Listee’s bundled core plugin allows anyone who registers a new account to specify the user_role parameter without proper sanitization. This flaw lets an unauthenticated attacker create an Administrator account and gain full control over the WordPress site, including the ability to modify content, install plugins, or exfiltrate data. The vulnerability is identified as CWE‑269, Improper Restriction of Operations within the Bounds of a User.

The issue applies to every release of the Listee WordPress theme published up to and including version 1.1.6. Sites running those versions are exposed regardless of other security settings, as the vulnerable registration code is shipped with the theme by Dreamstechnologies.

The base score of 9.8 indicates a critical flaw. The EPSS score of less than 1 % denotes a low probability of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog. Attackers can exploit the flaw by sending a crafted registration request to the public registration endpoint with the user_role set to Administrator; no prior authentication or special network permissions are required.