Critical · published June 7, 2023
🚨 Unauthenticated attackers can change any account detail, including admin email, with just a simple AJAX call! 🔥 Think of it like a guest at a party being able to change the host’s playlist without anyone noticing — a recipe for chaos! 🎶 An attacker could walk right in and alter crucial account details, potentially locking out admins or redirecting important communications. This vulnerability presents an open invitation for mischief and could lead to devastating consequences for site integrity and security.
Think of it like a guest at a party being able to change the host’s playlist without anyone noticing — a recipe for chaos! 🎶 The uListing plugin for WordPress lacks proper login checks on the stm_listing_profile_edit AJAX action, allowing unauthorized access to account modification functions for any user, authenticated or not.
An attacker could walk right in and alter crucial account details, potentially locking out admins or redirecting important communications. This vulnerability presents an open invitation for mischief and could lead to devastating consequences for site integrity and security. Immediate steps include updating the uListing plugin to version 1.6.7 or later where this flaw is fixed. Additionally, review your site for any suspicious account changes and strengthen overall access controls. 🔒 You've got this! With a quick update, you’ll secure your site and send those attackers packing! 🛡️