CVE-2025-12981

Description

The Listee theme for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.1.6. This is due to a broken validation check in the bundled listee-core plugin's user registration function that fails to properly sanitize the user_role parameter. This makes it possible for unauthenticated attackers to register as Administrator by manipulating the user_role parameter during registration.

PUBLISHED Reserved 2025-11-10 | Published 2026-02-27 | Updated 2026-02-27 | Assigner Wordfence

Problem types

CWE-269 Improper Privilege Management

Product status

Timeline

Credits

Ismail Syaleh finder

References

www.wordfence.com/...-d1b7-4544-b1c5-c23f37dd5bab?source=cve

themeforest.net/...e-classified-ads-wordpress-theme/44526956

themes.trac.wordpress.org/.../includes/listee-core-users.php

listee-wp.dreamstechnologies.com/...mentation/changelog.html

cve.org (CVE-2025-12981)

nvd.nist.gov (CVE-2025-12981)

Download JSON