uListing WordPress plugin: Missing authorization allows settings change
Summary
The uListing WordPress plugin up to and including version 2.2.0 lacks proper authorization checks (CWE-862) for changing plugin settings. An authenticated user with the Subscriber role can change plugin settings, bypassing the intended permission controls. The attacker needs a valid low-privilege account, so anonymous access alone is not sufficient, but open self-registration makes such accounts easy to obtain.
Affected
- uListing WordPress plugin versions up to and including 2.2.0 (per Patchstack and the CVE record)
- Start of the affected range: Unknown.
Fixed in
- Unknown. No fixed version or vendor advisory was found at the time of writing.
Workaround
- Deactivate and remove the plugin if it is not business-critical.
- Review Subscriber accounts and limit or disable open self-registration.
- Audit uListing settings for unexpected changes and restore known-good values.
- Patchstack offers virtual-patching rules for uListing; it is unconfirmed whether a rule covers this CVE.
Exploitation
- CISA SSVC: Exploitation none, Automatable no, Technical Impact partial.
- No public proof of concept found.
- Not listed as known exploited at the time of writing.
- Patchstack rates the issue as high priority and expects exploitation; this assessment is not independently confirmed.
Our recommendation
- Treat as high priority for any site running uListing 2.2.0 or older, especially with open registration.
- Remove or deactivate the plugin where feasible.
- Check the plugin settings for unexpected changes.
- Monitor the Patchstack entry and the vendor for a fixed version, and verify the CVE ID before applying any advisory data, as similar uListing CVEs exist.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory CVE-2026-62033 patchstack.com
- OpenCVE CVE-2026-62033 app.opencve.io
- Vulners CVE-2026-62033 vulners.com
- HOL Guard CVE-2026-62033 hol.org
- Strix CVE-2026-62033 www.strix.ai
- Wordfence uListing 2.2.0 Missing Authorization www.wordfence.com
- Patchstack uListing 2.1.7 Subscriber privilege escalation patchstack.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 10:03.
Original description (NVD)
Subscriber Settings Change in uListing <= 2.2.0 versions.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.