CVE-2025-12574
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
The Listar – Directory Listing & Classifieds WordPress Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the '/wp-json/listar/v1/place/delete' REST API endpoint in all versions up to, and including, 3.0.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary posts.
Risk Assessment
An attacker can delete data from the site, potentially leading to content loss.
Recommendation
Update the Listar plugin to the latest version and implement capability checks on the REST API endpoint.
Other vulnerabilities in Listar – Directory Listing & Classifieds WordPress Plugin
Original NVD description (English source)
The Listar – Directory Listing & Classifieds WordPress Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the '/wp-json/listar/v1/place/delete' REST API endpoint in all versions up to, and including, 3.0.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary posts.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS