Paper/Archive/CVE-2021-4343

CVE-2021-4343

stylemix Directory Listings WordPress plugin – uListing — uListing <= 1.6.6 - Unauthenticated Arbitrary Account Creation

EPSS 1%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD, CNA agree)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 72.3.723 × 2014.5 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

The Unauthenticated Account Creation plugin for WordPress is vulnerable to Unauthenticated Account Creation in versions up to, and including, 1.6.6. This is due to the stm_listing_register AJAX action function being accessible and taking roles unprotected. This makes it possible for unauthenticated attackers to create accounts, even those with administrator privileges.

Affected

ProductAffectedFixed inSource

Directory Listings WordPress plugin – uListing< 1.71.7CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Wordfence (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refwordfence.com/threat-intel/vulnerabilities/id/1c6bf45b-b02d-43bb-b682-7f1ae994e1d3?source=cve refblog.nintechnet.com/wordpress-ulisting-plugin-fixed-multiple-critical-vulnerabilities refplugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2456786%40ulisting&new=2456786%40ulisting&sfp_email=&sfph_mail=