The uListing WordPress plugin has a missing capability check on the stm_listing_ajax AJAX action in all releases up to and including version 2.2.0. This flaw allows any authenticated user with subscriber-level access or higher to call the action without restriction, update any post meta values, and inject PHP Objects that are unserialized. The absence of authorization contributes to CWE‑862, leading to unauthorized data modification and, through the leftover unserialize call, potential remote code execution if an attacker can craft a malicious serialized payload.

WordPress sites that have installed the uListing Directory Listings plugin from stylemix and are running any version through 2.2.0 are directly affected. Users experiencing subscriber or higher roles on those sites could exploit the flaw without needing elevated permissions.

The CVSS score of 8.8 indicates high severity, while the EPSS score of less than 1% suggests that widespread exploitation is currently unlikely. The vulnerability is not in the CISA KEV catalog. The likely attack vector requires an authenticated attacker who can send a crafted request to the AJAX endpoint, allowing them to tamper with post meta data or inject a PHP object for potential code execution.