The vulnerability identified in the WordPress uListing plugin allows a user with the subscriber role to modify plugin settings, effectively bypassing intended permission controls. This misuse of user privileges can lead to unauthorized configuration changes, potentially compromising site functionality, exposing sensitive data, or enabling further attacks. The flaw is classified under CWE‑862, indicating a privilege escalation issue.

Affected systems are WordPress sites that use the Stylemix uListing plugin version 2.2.0 or earlier. Site administrators should examine any installations running uListing 2.2.0 or older to determine exposure.

The CVSS score of 7.6 reflects a high severity, while the EPSS score is not available and the vulnerability is not currently listed in the CISA KEV catalog. Attackers would need to log in as a subscriber to exploit the flaw; the exploitation path relies on the plugin's unprotected settings interface. Given the missing EPSS data, the likelihood of active exploitation remains uncertain, but the high CVSS indicates a significant risk if a subscriber account is compromised or misused.