CVE-2025-12574 describes a missing authorization vulnerability in the passionui Listar – Directory Listing & Classifieds WordPress Plugin. The vulnerability exists in the REST API endpoint '/wp-json/listar/v1/place/delete', which lacks proper capability checks. As a result, authenticated users with Subscriber-level privileges or higher can delete arbitrary posts. This issue affects all versions up to and including 3.0.0. The CVSS 3.1 score is 4.3, reflecting a medium impact primarily on integrity due to unauthorized deletion of content. No patch or official fix has been documented, and no public exploits are known.

The vulnerability allows authenticated users with low-level privileges (Subscriber and above) to delete arbitrary posts via the vulnerable REST API endpoint. This results in unauthorized loss of data integrity but does not affect confidentiality or availability. The impact is limited to the ability to remove content without proper authorization checks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Subscriber-level user access where possible and monitor user activity for unauthorized deletions. Avoid granting unnecessary privileges to users. No official patch or workaround is currently documented.