CVE-2021-4370

CVE-2021-4370 is a critical authorization bypass vulnerability affecting the uListing plugin for WordPress, specifically versions up to and including 1.6.6. This flaw allows unauthenticated attackers to perform various administrative actions due to a lack of proper authentication, security nonces, and data validation. With a CVSS score of 9.8 (CRITICAL), the vulnerability is easily exploitable over the network with no user interaction required, potentially leading to complete compromise of confidentiality, integrity, and availability. While the EPSS and FAUCET scores indicate a moderate to high risk, there is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.