CVE-2026-62033

Summary

The uListing plugin allows authenticated users with subscriber roles to change settings that should be restricted to administrators, leading to potential privilege escalation and configuration changes that could impact site security and functionality.

Exploitability

Exploitation requires an attacker to have a subscriber-level account, making it moderately difficult but achievable through social engineering or compromised user credentials.

Blast radius

If exploited, this vulnerability could allow attackers to modify critical site settings, potentially leading to unauthorized access to sensitive data, configuration changes that affect site performance, and possible privilege escalation to administrator-level functionality.

Detection

Monitor for unusual setting modification requests in the WordPress admin logs, particularly those originating from subscriber accounts with elevated permissions or unexpected configuration changes that bypass normal administrative approval workflows.

Prioritized remediation

Upgrade to uListing version 2.2.1 or later to address the subscriber settings change vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.