CVE-2021-4381: stylemix directory listings wordpress plugin – ulisting Missing Authorization
Vulnerability summary
CVE-2021-4381 is a critical (CVSS 9.8) Missing Authorization vulnerability in stylemix directory listings wordpress plugin – ulisting. EPSS estimates a 1.39% chance of exploitation in the next 30 days, higher than 71.8% of scored vulnerabilities. 1 public exploit is recorded. Fixed in 1.7.
Timeline
- 07-06-2023PublishedVulnerability first disclosed.
- 08-04-2026Last modifiedVulnerability information updated.
Description
The uListing plugin for WordPress is vulnerable to authorization bypass via wp_route due to missing capability checks, and a missing security nonce, in the StmListingSingleLayout::import_new_layout method in versions up to, and including, 1.6.6. This makes it possible for unauthenticated attackers to change any WordPress option in the database.
CVSS metrics
3 scores · 3 sources · 1 version- NVDNIST9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- wordfenceSource9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
1.39%
Chance of exploitation in the next 30 days
Percentile
72%
Versus all other CVEs
30-day change
0.00 pp
From 1.39% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (blog.nintechnet.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
3 vendors · 3 products