CVE-2025-1657 describes a missing authorization (CWE-862) vulnerability in the Directory Listings WordPress plugin – uListing. The vulnerability exists in the stm_listing_ajax AJAX action, which lacks proper capability checks in all versions up to 2.2.0, allowing authenticated users with low privileges (subscriber-level and above) to update post meta data and inject PHP objects that may be unserialized. Although a capability check was added in version 2.1.8, the unsafe unserialize call persists, maintaining the risk of PHP Object Injection. This vulnerability can lead to unauthorized data modification and potential remote code execution or other impacts due to object injection.

An attacker with subscriber-level access or higher can exploit this vulnerability to modify post meta data unauthorizedly and inject PHP objects through unserialization, potentially leading to remote code execution or other severe impacts affecting confidentiality, integrity, and availability of the WordPress site. The CVSS score of 8.8 reflects a high severity level, indicating that successful exploitation could have a critical impact on the affected system.

No official patch or fix is currently confirmed or provided by the vendor for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict user roles to trusted users only and consider disabling or limiting access to the vulnerable AJAX action if possible. Monitor for updates from the vendor and apply official patches as soon as they are released.