CVE-2025-1653
📋 TL;DR
The uListing WordPress plugin has a privilege escalation vulnerability that allows authenticated users with Subscriber-level access or higher to elevate their privileges to administrator. This occurs because the stm_listing_profile_edit AJAX action doesn't properly restrict which user meta data can be updated. All WordPress sites using vulnerable versions of uListing are affected.
💻 Affected Systems
- uListing - Directory Listings WordPress plugin
📦 What is this software?
Ulisting by Stylemixthemes
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain full administrative control over the WordPress site, allowing them to install malicious plugins/themes, modify content, steal data, or establish persistent backdoors.
Likely Case
Attackers elevate privileges to administrator and use that access to deface the site, inject malicious code, or steal sensitive information.
If Mitigated
With proper access controls and monitoring, the attack would be detected and contained before significant damage occurs.
🎯 Exploit Status
Requires authenticated access (Subscriber role or higher). Exploitation involves sending crafted AJAX requests to modify user meta data.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 2.1.8 or later
Vendor Advisory: https://wordpress.org/plugins/ulisting/
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find 'uListing - Directory Listings' plugin. 4. Click 'Update Now' if update is available. 5. Alternatively, download version 2.1.8+ from WordPress.org and manually update.
🔧 Temporary Workarounds
Disable vulnerable AJAX endpoint
allRemove or restrict access to the vulnerable stm_listing_profile_edit AJAX action
Add to theme's functions.php or custom plugin: remove_action('wp_ajax_stm_listing_profile_edit', 'stm_listing_profile_edit'); remove_action('wp_ajax_nopriv_stm_listing_profile_edit', 'stm_listing_profile_edit');
Temporarily deactivate plugin
WordPressDisable the uListing plugin until patched
wp plugin deactivate ulisting
🧯 If You Can't Patch
- Implement strict role-based access controls and monitor for privilege escalation attempts
- Use web application firewall (WAF) rules to block suspicious AJAX requests to stm_listing_profile_edit endpoint
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > Installed Plugins for uListing version. If version is 2.1.7 or lower, you are vulnerable.Check Version:
wp plugin get ulisting --field=versionVerify Fix Applied:
After updating, verify uListing plugin version shows 2.1.8 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Multiple AJAX requests to /wp-admin/admin-ajax.php with action=stm_listing_profile_edit from non-admin users
- User role changes from Subscriber/Contributor to Administrator in WordPress logs
Network Indicators:
- POST requests to /wp-admin/admin-ajax.php containing 'action=stm_listing_profile_edit' and user meta modification parameters
SIEM Query:
source="wordpress.logs" AND (action="stm_listing_profile_edit" OR user_role_changed="administrator")