Skip to content
Sign in
7.5 High

CVE-2021-4339 The uListing plugin for WordPress is vulnerable to authorization bypass due to a missing capability check in the…

Description

The uListing plugin for WordPress is vulnerable to authorization bypass due to a missing capability check in the "ulisting/includes/route.php" file on the /1/api/ulisting-user/search REST-API route in versions up to, and including, 1.6.6. This makes it possible for unauthenticated attackers to retrieve the list of all users and their email address in the database.

Affected products and versions

Product Affected versions Fixed in
Directory Listings WordPress plugin – uListing 1.7 earliest → < 1.7 1.7

Other CVEs of Directory Listings WordPress plugin – uListing

The 12 CVEs of Directory Listings WordPress plugin – uListing →
CVE-2025-1653 The Directory Listings WordPress plugin – uListing plugin for WordPress is vulnerable to Privilege Escalation in all… 8.8 High CVE-2025-1657 The Directory Listings WordPress plugin – uListing plugin for WordPress is vulnerable to unauthorized modification of… 8.8 High CVE-2021-4381 The uListing plugin for WordPress is vulnerable to authorization bypass via wp_route due to missing capability checks,… 9.8 Critical CVE-2021-4370 The uListing plugin for WordPress is vulnerable to authorization bypass as most actions and endpoints are accessible… 9.8 Critical
Track this CVE