PT-2023-12481 · WordPress · Ulisting

Jerome Bruandet · Published 2023-06-07 · Updated 2023-06-13 · CVE-2021-4370

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions uListing plugin for WordPress versions prior to 1.6.7

Description The issue allows unauthorized access to most actions and endpoints, as they are accessible to unauthenticated users, lack security nonces, and data is seldom validated. This enables unauthenticated attackers to perform various administrative actions.

Recommendations For versions up to and including 1.6.6, update to version 1.6.7 or later to resolve the issue. As a temporary workaround, consider restricting access to administrative endpoints until a patch is available. Avoid using the plugin for sensitive administrative tasks until the issue is resolved.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2021-4370

Affected Products

Ulisting

References · 5

• 🔥 https://blog.nintechnet.com/wordpress-ulisting-plugin-fixed-multiple-critical-vulnerabilities · Exploit
• https://osv.dev/vulnerability/CVE-2021-4370 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-4370 · Security Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2456786%40ulisting&new=2456786%40ulisting&sfp_email=&sfph_mail= · Patch
• https://wordfence.com/threat-intel/vulnerabilities/id/c5ada976-03b8-4219-9ae3-9060fb7b9de5?source=cve · Note