PT-2026-20588 · WordPress · Clasifico Listing

Alyudin Nafiie · Publicado 2026-02-19 · Atualizado 2026-02-23 · CVE-2025-12882

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Clasifico Listing plugin for WordPress versions prior to 2.1

Description The Clasifico Listing plugin for WordPress allows users registering new accounts to set their own role using the listing user role parameter. This can allow unauthenticated attackers to gain elevated privileges, including administrator access, by registering an account with a higher role.

Recommendations Update to version 2.1 or later.

Correção

LPE

Improper Privilege Management

Enumeração de Fraquezas

CWE-269

Identificadores relacionados

CVE-2025-12882

Produtos afetados

Clasifico Listing

Referências · 7

• https://themeforest.net/item/clasifico-classified-ads-wordpress-theme/33539482 · Nota
• https://t.me/CVEtracker/45056 · Publicação no Telegram
• https://twitter.com/0dayPublishing/status/2024335659859603874 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-12882 · Nota de Segurança
• https://wordfence.com/threat-intel/vulnerabilities/id/70fb90f0-1ca4-41fe-8638-cdd05747adae?source=cve · Nota
• https://twitter.com/CveTodo/status/2024519404919136666 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2025892095383208335 · Publicação no Twitter