CVE-2025-1653: uListing Privilege Escalation Vulnerability

CVE-2025-1653 Overview

CVE-2025-1653 affects the Directory Listings WordPress plugin (uListing) developed by StyleMixThemes. The vulnerability exists in all versions up to and including 2.2.0. The flaw resides in the stm_listing_profile_edit AJAX action, which fails to restrict which user meta values can be updated. Authenticated attackers with Subscriber-level access or higher can elevate their privileges to administrator. The CWE classification is [CWE-266] Incorrect Privilege Assignment.

Critical Impact

Any registered WordPress user can gain full administrative control over sites running vulnerable versions of the uListing plugin, enabling site takeover, content modification, and arbitrary plugin installation.

Affected Products

• StyleMixThemes uListing plugin for WordPress (all versions ≤ 2.2.0)
• WordPress sites using the Directory Listings plugin
• Sites allowing user registration with the vulnerable plugin active

Discovery Timeline

• 2025-03-15 - CVE-2025-1653 published to NVD
• 2026-04-08 - Last updated in NVD database

Technical Details for CVE-2025-1653

Vulnerability Analysis

The vulnerability resides in the stm_listing_profile_edit AJAX handler exposed by the uListing plugin. This handler processes profile update requests from authenticated users. The handler accepts user meta key-value pairs from the client without enforcing an allowlist of permitted keys. As a result, an attacker can submit arbitrary user meta updates through the AJAX endpoint.

WordPress stores role and capability information in the wp_capabilities user meta entry. By targeting this meta key through the unrestricted AJAX action, a Subscriber-level account can rewrite its own capabilities to match the administrator role. The attack does not require interaction from any other user or administrator approval.

Once elevated, the attacker gains full control of the WordPress installation. This includes installing plugins, modifying theme files, creating additional administrator accounts, and accessing the database through the admin interface. The flaw is exploitable over the network against any site permitting user registration.

Root Cause

The root cause is missing authorization and input validation within the stm_listing_profile_edit AJAX action. The function does not validate which user meta keys a non-privileged user is allowed to modify. It also lacks a capability check restricting role and capability modifications to administrators.

Attack Vector

Exploitation requires an authenticated session at the Subscriber level or higher. The attacker sends a crafted POST request to wp-admin/admin-ajax.php invoking the stm_listing_profile_edit action with parameters targeting the wp_capabilities user meta. On WordPress sites with open registration, an attacker can self-register and exploit the flaw without any prior credentials.

The vulnerability mechanism is documented in the Wordfence Vulnerability Report. No public proof-of-concept code has been released at the time of writing.

Detection Methods for CVE-2025-1653

Indicators of Compromise

• Unexpected promotions of Subscriber or Contributor accounts to Administrator role within the wp_usermeta table
• POST requests to /wp-admin/admin-ajax.php containing action=stm_listing_profile_edit with parameters referencing wp_capabilities or wp_user_level
• Creation of new administrator accounts or installation of unfamiliar plugins shortly after suspicious AJAX traffic
• Modifications to wp-config.php, theme files, or upload of PHP files to the wp-content/uploads directory

Detection Strategies

• Audit the wp_usermeta table for users whose wp_capabilities value contains administrator but were originally registered with lower roles
• Enable WordPress access logging and inspect admin-ajax.php requests containing the stm_listing_profile_edit action originating from non-administrator sessions
• Deploy a web application firewall rule that inspects POST parameters to the vulnerable AJAX endpoint for role-related meta keys

Monitoring Recommendations

• Forward WordPress and web server logs to a centralized SIEM for correlation of AJAX activity with subsequent role changes
• Monitor the WordPress user_register and set_user_role hooks via an audit logging plugin to alert on unexpected role transitions
• Track file integrity for the wp-content/plugins/ulisting/ directory and core WordPress files to identify post-compromise modifications

How to Mitigate CVE-2025-1653

Immediate Actions Required

• Update the uListing plugin to a version above 2.2.0 as soon as a patched release is available from StyleMixThemes
• If no patch is available, deactivate and remove the uListing plugin from production WordPress installations
• Audit all WordPress user accounts and demote or remove any unauthorized administrator accounts
• Rotate credentials for all administrator accounts and review recently installed plugins or themes

Patch Information

Refer to the WordPress Plugin Repository page for uListing for the latest available version and changelog. Apply the vendor-supplied patch that introduces an allowlist of permitted user meta keys for the stm_listing_profile_edit AJAX handler. The Wordfence Vulnerability Report tracks fix availability.

Workarounds

• Disable user registration on the WordPress site by unchecking Settings → General → Membership until a patch is applied
• Restrict access to /wp-admin/admin-ajax.php for the stm_listing_profile_edit action using a web application firewall rule
• Apply the principle of least privilege by reviewing and removing unnecessary user accounts with Subscriber or higher roles

# Example WAF rule (ModSecurity) blocking exploitation attempts
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
  "chain,deny,status:403,id:1000653,msg:'Block uListing CVE-2025-1653 exploit'"
  SecRule ARGS:action "@streq stm_listing_profile_edit" \
    "chain"
    SecRule ARGS_NAMES "@rx (wp_capabilities|wp_user_level|wp_user-settings)"