The Listeo-Core plugin has a missing authorization check on an AJAX endpoint that handles media uploads. An attacker who can reach the site can submit arbitrary files to the media library without needing any credentials, allowing the insertion of malicious media. While this vulnerability does not provide direct code execution, it compromises the integrity of the media library and can serve as a foothold for further attacks or content defacement. The weakness is a lack of proper authentication and capability verification (CWE-434).

This issue affects the Purethemes Listeo-Core Directory Plugin for WordPress, versions 2.0.27 and all earlier releases. Users running these versions are vulnerable until the plugin is updated beyond 2.0.27.

The CVSS score of 5.3 indicates a medium severity risk. The EPSS score is unavailable, and the vulnerability is not listed in CISA's KEV catalog, but the lack of authentication on the upload endpoint suggests it could be exploited from any user with network access to the site. Since the attack requires no privileges, the risk of widespread compromise is moderate, though the potential for integrity damage and phishing remains significant. No direct code execution is possible, but the uploaded files could be used as a vector for other attacks if exploited further by attackers.