CVE-2025-12981: Privilege Escalation in Listee WordPress Theme

The impact of this vulnerability is severe. An attacker can exploit it to gain full administrative access to a WordPress site without needing any prior credentials. This grants them complete control over the site's content, configuration, users, and potentially the underlying server. They could deface the website, steal sensitive data, install malicious software, or use the compromised site as a launchpad for further attacks. The broken validation check in the user registration function is the root cause, enabling attackers to manipulate the user_role parameter and bypass security measures.

1. Reserved2025-11-10
2. Published2026-02-27
3. Modified2026-04-08
4. EPSS updated2026-03-23

The primary mitigation is to immediately upgrade the Listee WordPress theme to version 1.1.7 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider temporarily disabling user registration on the site to prevent new administrator accounts from being created maliciously. Review existing user accounts for any suspicious entries. WordPress administrators should also implement strong password policies and enable two-factor authentication to further enhance security. After upgrading, verify the fix by attempting to register a new user with an administrator role – the registration should fail.