CVE-2026-27392
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
The uListing plugin for WordPress versions 2.2.0 and earlier contains a broken access control vulnerability exploitable by a Contributor-level user.
Risk Assessment
An attacker with low privileges can gain unauthorized access to functions or data they should not be able to access.
Recommendation
Update the uListing plugin to the latest available version.
Other vulnerabilities in uListing
See all- CVE-2026-62031Critical
SQL Injection vulnerability in uListing versions up to and including 2.2.0. An unauthenticated attacker can inject malicious SQL queries, potentially leading to disclosure or modification of database data. The issue affects unauthenticated access.
- CVE-2026-62033High
Subscriber Settings Change in the uListing plugin up to version 2.2.0. A user can change subscription settings without proper permissions.
- CVE-2026-27391Medium
The uListing plugin for WordPress versions 2.2.0 and earlier contains a broken access control vulnerability exploitable by a Subscriber-level user.
Original NVD description (English source)
Contributor Broken Access Control in uListing <= 2.2.0 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS