CVE-2025-12577: Listar WordPress Plugin Auth Bypass Flaw

CVE-2025-12577 Overview

CVE-2025-12577 is a missing authorization vulnerability in the Listar – Directory Listing & Classifieds WordPress plugin. The flaw affects all versions up to and including 3.0.0. The /wp-json/listar/v1/place/save REST API endpoint lacks a capability check, allowing authenticated users with Subscriber-level access or above to modify listing details they do not own. The weakness is classified under [CWE-862] Missing Authorization.

Critical Impact

Any authenticated user, including low-privilege Subscribers, can update arbitrary directory listings, enabling content tampering, defacement, or fraudulent modification of business entries on affected WordPress sites.

Affected Products

• Listar – Directory Listing & Classifieds WordPress Plugin (all versions ≤ 3.0.0)
• WordPress sites exposing the plugin's REST API namespace listar/v1
• Directory and classifieds sites relying on the plugin's place/save endpoint

Discovery Timeline

• 2025-12-06 - CVE-2025-12577 published to the National Vulnerability Database
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12577

Vulnerability Analysis

The vulnerability resides in the REST API route /wp-json/listar/v1/place/save exposed by the Listar plugin. The endpoint accepts requests to create or update place listings but does not verify whether the authenticated caller has the appropriate capability or ownership over the target listing. WordPress REST routes must implement a permission_callback that returns a capability check such as current_user_can(). In this plugin, that check is either absent or returns a permissive value, so the endpoint treats any authenticated user identically.

Because WordPress installations frequently permit open user registration at the Subscriber role, this endpoint is reachable by attackers who register a free account. Once authenticated, an attacker can issue a POST request to the endpoint and modify listing content, contact information, categories, or metadata for entries belonging to other users. The impact is limited to integrity of listing data; confidentiality and availability are not directly affected.

Root Cause

The root cause is a missing capability check ([CWE-862]) in the REST route registration. The permission_callback associated with the place/save route does not enforce that the requesting user owns the targeted listing or holds an editing capability such as edit_posts or edit_others_posts.

Attack Vector

Exploitation requires network access to the WordPress site and valid Subscriber credentials. The attacker sends an authenticated POST request to /wp-json/listar/v1/place/save with a payload referencing an existing listing identifier and the fields to overwrite. No user interaction is required from the victim, and the attack can be automated across many listings. See the Wordfence Vulnerability Report for further technical context.

Detection Methods for CVE-2025-12577

Indicators of Compromise

• Unexpected POST requests to /wp-json/listar/v1/place/save originating from low-privilege user accounts
• Recent modifications to directory listings that do not match the listing owner's account activity
• Newly registered Subscriber accounts followed shortly by REST API activity targeting the listar/v1 namespace
• Web server access logs showing REST API calls with non-standard user agents or high request rates

Detection Strategies

• Enable WordPress REST API request logging and alert on writes to listar/v1/place/save from users lacking editorial roles
• Compare listing post_modified timestamps against the modifying user's user_registered date and role to spot mismatches
• Baseline normal editors of each listing and flag deviations where a Subscriber account edits another user's listing

Monitoring Recommendations

• Forward WordPress and web server logs to a centralized logging platform for correlation across authentication and REST API events
• Monitor for spikes in new user registrations paired with immediate REST API write activity
• Track database changes to the plugin's listing tables and correlate them with the authenticated user session that initiated them

How to Mitigate CVE-2025-12577

Immediate Actions Required

• Update the Listar – Directory Listing & Classifieds plugin to a version above 3.0.0 as soon as a patched release is available from the vendor
• Disable open user registration or restrict the default role to prevent anonymous attackers from obtaining Subscriber access
• Audit existing listings for unauthorized modifications and restore known-good content from backups where tampering is confirmed
• Review Subscriber accounts created recently and remove any that appear automated or unused

Patch Information

At the time of publication, refer to the WordPress plugin page for the latest release and changelog. Administrators should apply the vendor-supplied update once a fix addressing the missing capability check on /wp-json/listar/v1/place/save is published. Verify the fix by attempting the vulnerable request as a Subscriber account and confirming that the endpoint returns an authorization error.

Workarounds

• Deploy a Web Application Firewall (WAF) rule that blocks POST requests to /wp-json/listar/v1/place/save from users whose role is Subscriber or unauthenticated
• Temporarily deactivate the Listar plugin on sites that do not require it until a patched version is installed
• Use a mu-plugin or custom code to override the route's permission_callback with a strict current_user_can() check tied to listing ownership

# Configuration example: block the vulnerable endpoint at the web server (nginx)
location ~* ^/wp-json/listar/v1/place/save {
    limit_except GET { deny all; }
}