CVE-2025-69190CWE-862

WordPress Listihub theme <= 1.0.6 - Broken Access Control vulnerability

High · published January 22, 2026

CVSS v3.1
7.3
EPSS
0%
Percentile
16.8
In the wild
Unconfirmed
What it is

⚡ A missing authorization check in Listihub could allow unauthorized users to access sensitive functionalities—like leaving the door wide open for prying eyes! 🔎 This vulnerability is like a restaurant that forgets to check reservations at the door, allowing anyone to waltz in and take a seat, regardless of who they really are. If you have a VIP area, you definitely want to keep it exclusive! An attacker could exploit this flaw to access or manipulate data that they shouldn't be able to see, leading to potential data breaches or unauthorized actions. With the wrong hands on the controls, the consequences could be absolutely devastating!

Put simply

This vulnerability is like a restaurant that forgets to check reservations at the door, allowing anyone to waltz in and take a seat, regardless of who they really are. If you have a VIP area, you definitely want to keep it exclusive! This missing authorization vulnerability occurs when Listihub improperly configures access control security levels, allowing unauthorized users to bypass restrictions and gain access to sensitive features.

What to do

An attacker could exploit this flaw to access or manipulate data that they shouldn't be able to see, leading to potential data breaches or unauthorized actions. With the wrong hands on the controls, the consequences could be absolutely devastating! To safeguard your application, patch Listihub to version 1.0.7 or later immediately. Additionally, review your access control settings to ensure that all security levels are correctly configured. Regular audits can help prevent these sneaky issues from causing havoc in the future! You’ve got this! By following these steps, you'll solidify your defenses and keep unauthorized users out! 🛡️

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00260 · 16.8th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-01-22T16:52Z
EPSS history
Timeline
  • 22 JAN 16:52Z
    WordPress Listihub theme <= 1.0.6 - Broken Access Control vulnerability
    cvelistv5