{"id":"CVE-2026-62033","published":"2026-10-10T20:16:39.480","lastModified":"2026-10-13T13:28:15.717","description":"Subscriber Settings Change in uListing <= 2.2.0 versions.","cvssScore":7.6,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","cwes":["CWE-862"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/ulisting/vulnerability/wordpress-ulisting-plugin-2-2-0-settings-change-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The uListing plugin allows authenticated users with subscriber roles to change settings that should be restricted to administrators, leading to potential privilege escalation and configuration changes that could impact site security and functionality.","exploitability":"Exploitation requires an attacker to have a subscriber-level account, making it moderately difficult but achievable through social engineering or compromised user credentials.","blast_radius":"If exploited, this vulnerability could allow attackers to modify critical site settings, potentially leading to unauthorized access to sensitive data, configuration changes that affect site performance, and possible privilege escalation to administrator-level functionality.","remediation":"Upgrade to uListing version 2.2.1 or later to address the subscriber settings change vulnerability.","detection":"Monitor for unusual setting modification requests in the WordPress admin logs, particularly those originating from subscriber accounts with elevated permissions or unexpected configuration changes that bypass normal administrative approval workflows.","tags":["privilege-escalation","wp-plugin","access-control"],"model":"garnet-coder","analyzedAt":"2026-10-18T10:10:17.521Z"}}