This vulnerability in ListingPro (<= 2.9.10) is a broken access control issue where subscriber authorization checks are missing or insufficient (CWE-862). An attacker with low privileges can access subscriber-only features or data without proper authorization. The CVSS 3.1 vector indicates the attack can be performed remotely over the network, requires low privileges, and does not require user interaction, resulting in limited confidentiality and integrity impact but no availability impact. No vendor advisory or patch information is currently available, and no known exploits have been reported.

An attacker with low privileges may bypass subscriber access controls, potentially gaining unauthorized access to subscriber-only content or functionality. This could lead to limited confidentiality and integrity impacts, such as exposure or modification of subscriber data. There is no reported impact on system availability. No known active exploitation has been observed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to ListingPro installations to trusted users and monitor for suspicious activity related to subscriber access. Avoid exposing vulnerable versions to untrusted networks where possible.