Description
Missing Authorization vulnerability in CridioStudio ListingPro listingpro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ListingPro: from n/a through < 2.9.10.
Published: 2025-12-18
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A missing authorization check allows an attacker to bypass normal access controls and perform actions that should be restricted to privileged users. The vulnerability, identified as a CWE-862 Broken Access Control, could enable unauthorized manipulation of data, configuration settings, or the execution of privileged functions within the WordPress site using the ListingPro theme.

Affected Systems

CridioStudio ListingPro theme for WordPress, in all releases prior to version 2.9.10. Any WordPress installation using a ListingPro theme version older than 2.9.10 is affected, regardless of other configuration.

Risk and Exploitability

The CVSS score of 7.1 indicates a high‑impact vulnerability, but the EPSS score of less than 1% suggests a low likelihood of immediate exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker could exploit the flaw by issuing crafted HTTP requests to endpoints that should be protected, potentially without authentication or with minimal privileges, thereby gaining elevated access to the site.

Generated by OpenCVE AI on April 30, 2026 at 04:44 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update ListingPro to version 2.9.10 or later to apply the vendor patch
  • If an update is unavailable, temporarily restrict access to the affected endpoints by applying custom access‑control rules in the site’s configuration or by disabling privileged actions through a custom plugin or security plugin
  • Apply a temporary firewall rule or use a Web Application Firewall to block unauthenticated requests to the vulnerable endpoints until a patch is applied

Generated by OpenCVE AI on April 30, 2026 at 04:44 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 23 Apr 2026 15:00:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N'}

 cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N'}

Tue, 20 Jan 2026 15:30:00 +0000

Type Values Removed Values Added
References

Tue, 20 Jan 2026 14:45:00 +0000

Type Values Removed Values Added
References

Fri, 19 Dec 2025 09:30:00 +0000

Type Values Removed Values Added
First Time appeared Wordpress
Wordpress wordpress
Vendors & Products Wordpress
Wordpress wordpress

Thu, 18 Dec 2025 16:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 18 Dec 2025 07:45:00 +0000

Type Values Removed Values Added
Description Missing Authorization vulnerability in CridioStudio ListingPro listingpro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ListingPro: from n/a through < 2.9.10.
Title WordPress ListingPro theme < 2.9.10 - Broken Access Control vulnerability
Weaknesses CWE-862
References

Subscriptions

Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-04-28T16:14:14.807Z

Reserved: 2025-10-31T11:23:19.708Z

Link: CVE-2025-64378

cve-icon Vulnrichment

Updated: 2025-12-18T16:07:50.272Z

cve-icon NVD

Status : Deferred

Published: 2025-12-18T08:16:14.897

Modified: 2026-04-27T16:16:42.240

Link: CVE-2025-64378

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-30T04:45:06Z

Weaknesses