Critical · published June 7, 2023
🚨 An unauthenticated attacker can delete any post or page on your WordPress site! This vulnerability in the uListing plugin affects versions up to 1.6.6. 🔥 Think of it as someone sneaking into an office without any ID. They can waltz right up to the filing cabinets and start tossing out documents, completely unchecked! This is absolutely devastating! An attacker could wipe out your site’s content, leaving you scrambling to recover what was lost. Imagine losing all your important posts and pages in one fell swoop — your hard work vanishing like a puff of smoke!
Think of it as someone sneaking into an office without any ID. They can waltz right up to the filing cabinets and start tossing out documents, completely unchecked! The uListing plugin for WordPress lacks necessary capability checks and security nonces in the UlistingUserRole::save_role_api function, allowing unauthorized users to delete content without any restrictions.
This is absolutely devastating! An attacker could wipe out your site’s content, leaving you scrambling to recover what was lost. Imagine losing all your important posts and pages in one fell swoop — your hard work vanishing like a puff of smoke! Immediately update the uListing plugin to version 1.6.7 or higher to close this loophole. Additionally, review your plugin settings to ensure that only authorized users have the necessary capabilities. 🛡️ You've got this! Fixing this vulnerability will make your site much more secure. Let's get to it! 💪🎉