CVE-2021-4341

CVE-2021-4341 is a critical authorization bypass vulnerability affecting the uListing plugin for WordPress, versions up to and including 1.6.6. This flaw, stemming from missing capability checks, input validation, and a security nonce in the stm_update_email_data AJAX action, allows unauthenticated attackers to modify any WordPress option in the database. With a CVSS score of 9.8 (Critical), it presents a high risk due to its network-based attack vector, low complexity, and potential for complete compromise of confidentiality, integrity, and availability. While no active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion has been observed, its critical nature warrants immediate patching.