Executive brief
The Listeo Core plugin for WordPress, which provides directory and listing functionality, contains a security flaw that allows unauthorized users to upload files. An attacker can use this to upload arbitrary media files to the website's media library. While this does not directly allow them to take over the site, it can lead to storage exhaustion or the hosting of malicious content on the company's domain.
Technical details
The Listeo Core plugin for WordPress is vulnerable to unauthenticated arbitrary media upload via the 'listeo_core_handle_dropped_media' function. This vulnerability stems from a lack of authorization and capability checks on the AJAX endpoint responsible for handling file uploads. An unauthenticated attacker can exploit this by sending a crafted request to the endpoint, allowing them to upload files to the WordPress media library. While the vulnerability does not facilitate direct remote code execution (RCE), it allows for unauthorized modification of the site's media repository. The issue is addressed in subsequent versions, with security fixes noted in the 2.0.48 changelog.
Affected products
- Purethemes Listeo Core - Directory Plugin by Purethemes <= 2.0.27
Timeline
- 2026-04-04: advisory: Initial disclosure by Wordfence
- 2026-04-04: disclosed
- 2026-06-18: patched: Security fixes included in version 2.0.48