Is CVE-2026-65478 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-65478 being exploited in the wild.

How severe is CVE-2026-65478?

Medium severity, with a CVSS score of 5.4, published 23 July 2026.

Which products and versions are affected?

CridioStudio ListingPro <= 2.9.10.

Is there a fix for CVE-2026-65478?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-65478 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-65478?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-65478: CridioStudio ListingPro broken access control in WordPress plugin

Q: Is there a fix for CVE-2026-65478?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-65478 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-65478?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-65478 · Severity: medium · CVSS 5.4 · Published 2026-07-23

ListingPro, a popular WordPress plugin used for creating directory and listing websites, contains a security flaw that allows users with basic 'Subscriber' accounts to perform actions they should not be authorized to access. This could allow low-level users to view restricted information or modify certain site settings, potentially compromising the integrity of the directory data. While the impact is considered moderate, it represents a failure in the system's permission controls.

Quick answers

Is CVE-2026-65478 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-65478 being exploited in the wild.
How severe is CVE-2026-65478?: Medium severity, with a CVSS score of 5.4, published 23 July 2026.
Which products and versions are affected?: CridioStudio ListingPro <= 2.9.10.
Is there a fix for CVE-2026-65478?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-65478 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-65478?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A broken access control vulnerability exists in the ListingPro plugin for WordPress (versions <= 2.9.10) due to missing authorization checks (CWE-862). The flaw allows an authenticated attacker with low-level 'Subscriber' privileges to execute functions or access data that should be restricted to higher-privileged roles. The attack is reachable over the network and does not require user interaction. As of the advisory date, no official patch has been released, and the vulnerability remains unpatched in version 2.9.10.

Affected products

CridioStudio ListingPro <= 2.9.10

Timeline

2026-01-22: disclosed: Reported by Phat RiO to Patchstack
2026-07-22: advisory: Patchstack published advisory
2026-07-23: advisory: NVD published CVE record

References

https://patchstack.com/database/wordpress/plugin/listingpro-plugin/vulnerability/wordpress-listingpro-plugin-2-9-10-broken-access-control-vulnerability?_s_id=cve

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.