The vulnerability in Reveal Listing allows anyone who can register a new account to assign themselves the administrator role. This bypasses normal WordPress role restrictions and gives full control over the site, including changing themes, installing plugins, and accessing sensitive data. The weakness is an improper privilege management flaw, identified as CWE‑269.

SmartDataSoft’s Reveal Listing WordPress theme is affected in all releases version 3.3 and earlier. WordPress sites that have the plugin installed and still allow open registration are susceptible. No other versions or products are listed.

The CVSS score of 9.8 indicates critical severity, while the EPSS score of less than 1 % shows a very low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by simply submitting a registration request with the "listing_user_role" parameter set to an administrative role, requiring no credentials. Once the account is created, the attacker has full administrative privileges.