Listee <= 1.1.6 - Unauthenticated Privilege Escalation

The impact of this vulnerability is severe. An attacker exploiting CVE-2025-12981 can gain complete administrative control over a WordPress site without requiring any prior authentication. This allows them to modify content, install malicious plugins, steal sensitive data (user credentials, financial information, customer data), and potentially compromise the entire server. The ease of exploitation, requiring only a crafted registration request, significantly increases the risk of widespread attacks targeting sites using the vulnerable Listee theme. This vulnerability shares similarities with other WordPress privilege escalation flaws where improper input validation leads to unauthorized access.

Websites using the Listee WordPress theme, particularly those running vulnerable versions (1.0.0–1.1.6), are at significant risk. Shared hosting environments where multiple websites share the same server are also at increased risk, as a compromise on one site could potentially lead to lateral movement to others. Sites with weak password policies or disabled user registration are especially vulnerable.

• wordpress / composer / npm:

wp plugin list | grep listee-core

• wordpress / composer / npm:

wp plugin update listee-core --version=1.1.7

• wordpress / composer / npm:

grep -r 'user_role' /var/www/html/wp-content/plugins/listee-core/

• generic web: Check WordPress plugin directory for mentions of the vulnerability and associated indicators.

1. 2026-02-27Disclosure

   disclosure

1. Reserviert2025-11-10
2. Veröffentlicht2026-02-27
3. Geändert2026-04-08
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-12981 is to immediately upgrade the Listee WordPress theme to version 1.1.7 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider temporarily disabling user registration on the affected site to prevent further exploitation. While not a complete solution, implementing a Web Application Firewall (WAF) with rules to block suspicious registration requests containing manipulated user roles can provide an additional layer of defense. Regularly review WordPress user accounts for any unexpected administrator accounts.