The Clasifico Listing plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.0. This is due to the plugin allowing users who are registering new accounts to set their own role by supplying the 'listing_user_role' parameter. This makes it possible for unauthenticated attackers to gain elevated privileges by registering an account with the administrator role.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Smartdatasoft |
|
| Wordpress |
|
No data.
No data.
References
History
Thu, 19 Feb 2026 10:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Smartdatasoft
Smartdatasoft clasifico Listing Wordpress Wordpress wordpress |
|
| Vendors & Products |
Smartdatasoft
Smartdatasoft clasifico Listing Wordpress Wordpress wordpress |
Thu, 19 Feb 2026 04:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The Clasifico Listing plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.0. This is due to the plugin allowing users who are registering new accounts to set their own role by supplying the 'listing_user_role' parameter. This makes it possible for unauthenticated attackers to gain elevated privileges by registering an account with the administrator role. | |
| Title | Clasifico Listing <= 2.0 - Unauthenticated Privilege Escalation | |
| Weaknesses | CWE-269 | |
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: Wordfence
Published: 2026-02-19T03:25:15.804Z
Updated: 2026-02-19T03:25:15.804Z
Reserved: 2025-11-07T16:19:24.522Z
Link: CVE-2025-12882
Vulnrichment
No data.
NVD
No data.
Redhat
No data.