CVE-2026-62033

Received Received - Intake

Subscriber Settings Change in uListing <= 2.2.0

Publication date: 2026-10-10

Last updated on: 2026-10-10

Assigner: Patchstack

Description

Subscriber Settings Change in uListing <= 2.2.0 versions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-10

Last Modified

2026-10-10

Generated

2026-10-11

AI Q&A

2026-10-11

EPSS Evaluated

N/A

NVD

CVE-2026-62033

EUVD

EUVD-2026-96468

Affected Vendors & Products

Vendor	Product	Version / Range
Stylemix	uListing	n/a

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

CVE-2026-62033 is a vulnerability in the WordPress uListing Plugin versions 2.2.0 and below. It allows attackers with subscriber-level access to modify site settings, potentially disabling security features or altering configurations to lock users out.

Detection Guidance

Check for unauthorized changes in WordPress site settings by reviewing recent modifications made by subscriber-level accounts. Look for unexpected plugin or theme configuration changes. Monitor access logs for unusual activity from subscriber roles.

Impact Analysis

This vulnerability can lead to unauthorized changes in site settings, disabling security features, or locking users out of the site. Attackers with subscriber access could exploit it to cause significant disruptions or compromise site integrity.

Mitigation Strategies

Apply Patchstack's mitigation rule to block attacks. Update the uListing plugin if an official patch is released. Restrict subscriber-level access to only necessary permissions. Consider disabling the plugin temporarily if no update is available.

Hi! I’m here to help you understand CVE-2026-62033. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70