# CVE-2026-27391: Stylemix uListing broken access control in WordPress plugin

Source: https://junglewise.ai/threats/cve-2026-27391-stylemix-ulisting-broken-access-control-in-wordpress-plugin  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-23. Updated: 2026-07-23  
License: CC BY 4.0 with a link back

CVE-2026-27391 · Severity: medium · CVSS 5.4 · Published 2026-07-23

uListing, a WordPress plugin used for creating business directories and listing sites, contains a security flaw that allows users with basic 'Subscriber' accounts to perform unauthorized actions. An attacker with a low-level account could potentially modify site data or disrupt operations by bypassing intended access restrictions. This could lead to unauthorized changes to listings or minor service disruptions on the affected website.

Technologies: [StylemixThemes uListing](https://junglewise.ai/threats/technologies/ulisting). Vendors: [StylemixThemes](https://junglewise.ai/threats/vendors/stylemixthemes).

## Quick answers

**Is CVE-2026-27391 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-27391 being exploited in the wild.

**How severe is CVE-2026-27391?** Medium severity, with a CVSS score of 5.4, published 23 July 2026.

**Which products and versions are affected?** StylemixThemes uListing <= 2.2.0.

**Is there a fix for CVE-2026-27391?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-27391 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-27391?** Check whether you run StylemixThemes uListing at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A broken access control vulnerability (CWE-862: Missing Authorization) exists in the Stylemix uListing plugin for WordPress in versions up to 2.2.0. The flaw is rooted in insufficient authorization checks, which allows an authenticated attacker with Subscriber-level privileges to execute functions or actions that should be restricted to higher-privileged users. The attack is network-reachable and requires low privileges but no user interaction. Successful exploitation could allow an attacker to modify data or impact the availability of certain plugin features. As of the advisory date, no official patch has been confirmed.

## Affected products

- StylemixThemes uListing <= 2.2.0

## Timeline

- 2025-11-16: other: Vulnerability reported by researcher daroo
- 2026-07-22: advisory: Patchstack published advisory
- 2026-07-23: disclosed: CVE published to NVD dataset

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/ulisting/vulnerability/wordpress-ulisting-plugin-2-2-0-broken-access-control-vulnerability-2?_s_id=cve](https://patchstack.com/database/wordpress/plugin/ulisting/vulnerability/wordpress-ulisting-plugin-2-2-0-broken-access-control-vulnerability-2?_s_id=cve)

## Related threats

- [StylemixThemes uListing broken access control](https://junglewise.ai/threats/cve-2026-27392-stylemixthemes-ulisting-broken-access-control)