CVE-2025-1653 is a privilege escalation vulnerability in the Directory Listings WordPress plugin – uListing, affecting all versions up to 2.2.0. The issue stems from inadequate access control on the stm_listing_profile_edit AJAX action, which permits authenticated users with low-level privileges (Subscriber and above) to modify user meta data improperly, enabling them to elevate their privileges to administrator. This vulnerability is classified under CWE-266 (Incorrect Privilege Assignment) and carries a CVSS 3.1 base score of 8.8, indicating high impact on confidentiality, integrity, and availability.

An attacker with authenticated access at Subscriber level or higher can exploit this vulnerability to gain administrator privileges on the affected WordPress site. This could lead to full site compromise, including the ability to modify content, install malicious plugins, or access sensitive data. The vulnerability affects all versions up to and including 2.2.0 of the plugin. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should consider restricting access to the plugin's AJAX actions or limiting user roles that can interact with the plugin. Monitoring for unusual privilege escalations and applying WordPress security best practices may help reduce risk, but no specific official mitigation is currently documented.