CVE-2025-12882: Privilege Escalation in Clasifico Listing

The impact of this vulnerability is severe. An attacker successfully exploiting CVE-2025-12882 gains complete control over the affected WordPress site. This includes the ability to modify content, install malicious plugins, create new user accounts with elevated privileges, and potentially access sensitive data stored within the WordPress database. The attacker could deface the website, steal user credentials, or use the compromised site as a launchpad for further attacks against other systems on the network. This vulnerability shares similarities with other privilege escalation flaws where user registration parameters are not properly validated, potentially leading to widespread compromise.

1. Reserved2025-11-07
2. Published2026-02-19
3. Modified2026-04-08
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-12882 is to immediately upgrade the Clasifico Listing plugin to version 2.1 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing a temporary workaround by restricting user role assignment during registration. This could involve modifying the plugin's code (if possible) or using a WordPress plugin that enforces stricter user role controls. Monitor WordPress logs for suspicious account creation attempts, particularly those involving administrator role assignments. After upgrading, verify the fix by attempting to register a new account and confirming that the 'listinguserrole' parameter is properly validated and does not allow setting the role to 'administrator'.