CVE-2025-12574

🗓️ 06 Dec 2025 05:49:24Reported by WordfenceType

cve🔗 web.nvd.nist.gov👁 3 Views🌐 WEB

Listar plugin <=3.0.0 lets Subscriber+ delete posts via delete endpoint due to authorization.

Reporter	Title	Published	Views	Family All 9
CNNVD	WordPress plugin Listar – Directory Listing & Classifieds WordPress Plugin 安全漏洞	6 Dec 202500:00	–	cnnvd
Cvelist	CVE-2025-12574 Listar – Directory Listing & Classifieds WordPress Plugin <= 3.0.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion	6 Dec 202505:49	–	cvelist
EUVD	EUVD-2025-201532	6 Dec 202506:30	–	euvd
NVD	CVE-2025-12574	6 Dec 202506:15	–	nvd
Patchstack	WordPress Listar – Directory Listing & Classifieds WordPress Plugin plugin <= 3.0.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion vulnerability	8 Dec 202513:05	–	patchstack
Positive Technologies	PT-2025-49331	6 Dec 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-12574	7 Dec 202506:05	–	redhatcve
Vulnrichment	CVE-2025-12574 Listar – Directory Listing & Classifieds WordPress Plugin <= 3.0.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion	6 Dec 202505:49	–	vulnrichment
Wordfence Blog	Wordfence Intelligence Weekly WordPress Vulnerability Report (December 1, 2025 to December 7, 2025)	11 Dec 202517:00	–	wordfence

Vulners

Node

passionui listar_directory_listing_&_classifieds_wordpress_pluginRange≤3.0.0wordpress

[
  {
    "vendor": "passionui",
    "product": "Listar – Directory Listing & Classifieds WordPress Plugin",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "3.0.0",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/33b98bee-7f33-4d49-96e1-9a1eafc92bb3
wordpress	www.wordpress.org/plugins/listar-directory-listing/

Parameter	Position	Path	Description	CWE
place_id	path	/wp-json/listar/v1/place/delete	Unauthorized deletion of posts due to missing capability check on the Listar plugin delete endpoint.	CWE-862

15 Apr 2026 00:35Current

4.9Medium risk

Vulners AI Score4.9

CVSS 3.14.3

EPSS0.00036

SSVC

CWE-862