CVE-2026-24972
Missing Authorization in Elated Listing Plugin Allows Unauthorized Access
Publication date: 2026-03-25
Last updated on: 2026-04-23
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| elated_themes | elated_listing | to 1.4 (inc) |
| elated_themes | eltd_listing | From 1.0 (inc) to 1.4 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-24972 is a medium priority Broken Access Control vulnerability in the WordPress Elated Listing Plugin versions 1.4 and earlier.
It occurs due to missing authorization, authentication, or nonce token checks in certain plugin functions, which allows unprivileged users (even those with only subscriber-level privileges) to perform actions that should be restricted to higher privileged roles.
This vulnerability is classified under the OWASP Top 10 category A1: Broken Access Control and has a CVSS score of 6.5, indicating moderate severity.
How can this vulnerability impact me? :
This vulnerability allows relatively low-privileged users to perform unauthorized actions within the affected WordPress plugin.
Because it requires only subscriber-level privileges to exploit, attackers can leverage this flaw to escalate their access or manipulate the plugin's functionality in unintended ways.
It is known to be exploitable in mass campaigns targeting many websites regardless of their traffic or popularity, potentially leading to widespread unauthorized access or control.
Immediate mitigation involves updating the plugin to version 1.5 or later, where the issue has been patched.
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation involves updating the Elated Listing plugin to version 1.5 or later, where the vulnerability has been patched.
Until the update is applied, Patchstack provides an automatic mitigation rule to block attacks targeting this vulnerability.
Users unable to update immediately are advised to seek assistance from their hosting providers or web developers.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability is a Broken Access Control issue that allows unprivileged users to perform actions reserved for higher privileged roles. This type of security flaw can potentially lead to unauthorized access to sensitive data or system functions.
While the provided information does not explicitly mention compliance with standards like GDPR or HIPAA, missing authorization and broken access control vulnerabilities generally pose risks to data confidentiality and integrity, which are critical aspects of these regulations.
Therefore, if exploited, this vulnerability could lead to non-compliance with regulations that require strict access controls and protection of personal or sensitive data.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
The CVE-2026-24972 vulnerability is a Broken Access Control issue in the Elated Listing WordPress plugin versions 1.4 and earlier, allowing unprivileged users to perform restricted actions. Detection involves monitoring for unauthorized access attempts or unusual activity from subscriber-level accounts.
Since the vulnerability arises from missing authorization checks in plugin functions, detection can focus on identifying requests that attempt to invoke these functions without proper privileges.
Specific commands are not provided in the available resources. However, general approaches include:
- Reviewing web server logs for suspicious POST or GET requests targeting the Elated Listing plugin endpoints.
- Using tools like curl or wget to simulate requests as a low-privileged user to test if restricted actions can be performed.
- Employing web application firewalls (WAFs) or Patchstack's automatic mitigation rules to detect and block exploitation attempts.
Immediate mitigation is recommended by updating the plugin to version 1.5 or later, which patches the vulnerability.