PT-2026-20588 · WordPress · Clasifico Listing

Alyudin Nafiie · Published 2026-02-19 · Updated 2026-02-23 · CVE-2025-12882

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Clasifico Listing plugin for WordPress versions prior to 2.1

Description The Clasifico Listing plugin for WordPress allows users registering new accounts to set their own role using the listing user role parameter. This can allow unauthenticated attackers to gain elevated privileges, including administrator access, by registering an account with a higher role.

Recommendations Update to version 2.1 or later.

Fix

LPE

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2025-12882

Affected Products

Clasifico Listing

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-12882 · Security Note
• https://themeforest.net/item/clasifico-classified-ads-wordpress-theme/33539482 · Note
• https://t.me/CVEtracker/45056 · Telegram Post
• https://twitter.com/0dayPublishing/status/2024335659859603874 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/70fb90f0-1ca4-41fe-8638-cdd05747adae?source=cve · Note
• https://twitter.com/CveTodo/status/2024519404919136666 · Twitter Post
• https://twitter.com/CVEnew/status/2025892095383208335 · Twitter Post