CVE-2026-65478
Received Received - Intake

Subscriber Broken Access Control in ListingPro <= 2.9.10

Publication date: 2026-07-23

Last updated on: 2026-07-23

Assigner: Patchstack

Description
Subscriber Broken Access Control in ListingPro <= 2.9.10 versions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-23
Last Modified
2026-07-23
Generated
2026-07-23
AI Q&A
2026-07-23
EPSS Evaluated
N/A
NVD
CVE-2026-65478
EUVD
EUVD-2026-48089

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
patchstack listpro_plugin to 2.9.10 (inc)
listingpro listingpro to 2.9.10 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Broken Access Control vulnerability in the WordPress ListingPro Plugin versions 2.9.10 and below. It allows users with a Subscriber role to perform actions that require higher privileges due to missing authorization, authentication, or nonce token checks.

Detection Guidance

Check if the ListingPro plugin version 2.9.10 or below is installed on your WordPress site. You can do this by logging into your WordPress dashboard, navigating to Plugins, and reviewing the version of the ListingPro plugin. Alternatively, use the command: wp plugin list --name=listingpro to check via WP-CLI.

Impact Analysis

Unauthenticated users could exploit this to perform unauthorized actions, potentially modifying or accessing sensitive data. While classified as low severity, it may still pose risks depending on plugin usage and data exposure.

Compliance Impact

Broken Access Control can lead to unauthorized data exposure or modification, violating GDPR's data integrity and HIPAA's access control requirements. Compliance risks depend on the data processed by the plugin.

Mitigation Strategies

Immediately update the ListingPro plugin to the latest version if available. If no patch exists, consider disabling the plugin temporarily or seeking assistance from a hosting provider or web developer. Monitor for unusual activity from Subscriber role accounts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-65478. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart