PT-2026-30342 · WordPress · Listeo-Core

Paolo Tresso · Published 2026-04-04 · Updated 2026-04-04 · CVE-2025-14938

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Listeo Core plugin for WordPress versions through 2.0.27

Description The Listeo Core plugin for WordPress is susceptible to unauthenticated arbitrary media upload. This is due to missing authorization and capability checks on the AJAX endpoint handling file uploads. An unauthenticated attacker can upload arbitrary media to the site's media library via the listeo core handle dropped media function, without achieving direct code execution.

Recommendations Update the Listeo Core plugin to a version later than 2.0.27.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-14938

Affected Products

Listeo-Core

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-14938 · Security Note
• https://docs.purethemes.net/listeo/knowledge-base/changelog-listeo · Note
• https://twitter.com/CVEnew/status/2040481237815759130 · Twitter Post
• https://twitter.com/cyberbivash/status/2040418168330498210 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/4decf597-1819-402f-ab28-2446a3e6215f?source=cve · Note