Subscriber Broken Access Control in uListing <= 2.2.0

Executive Summary

The uListing WordPress plugin versions 2.2.0 and below has a Broken Access Control vulnerability (CVE-2026-27391). This flaw allows users with a Subscriber role to perform actions that require higher privileges due to missing authorization checks. The vulnerability is classified under OWASP Top 10 A1: Broken Access Control.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if the uListing plugin version 2.2.0 or below is installed on your WordPress site. Inspect user roles and permissions for unauthorized access attempts. Review server logs for suspicious activity from Subscriber-level users performing privileged actions.

Useful 0 Not Useful 0

Impact Analysis

Unauthenticated or low-privilege users could exploit this to perform unauthorized actions on affected websites. While the CVSS score is low (5.4), attackers might use it in mass campaigns targeting multiple sites. Immediate action like updating the plugin or seeking developer assistance is recommended.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially affect compliance with GDPR and HIPAA by allowing unauthorized access to sensitive data. Broken access control may lead to unauthorized users viewing or modifying restricted information, which violates data protection requirements under these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the uListing plugin to the latest version if available. If no patch exists, consider disabling the plugin or restricting access to untrusted users. Contact your hosting provider or a developer for assistance.

Useful 0 Not Useful 0