Introduction
Attackers can register as administrators on vulnerable WordPress sites running the Reveal Listing plugin. The flaw is in the registration process, and it lets an attacker take over the whole site with minimal effort. For organizations that run directory or listing features on this plugin, the risk is immediate and severe.
About the involved software: Reveal Listing is a commercial WordPress plugin by SmartDataSoft, distributed via ThemeForest. People use it to build directory and listing sites, and its users include a range of small and medium businesses. That user base means a vulnerability in this plugin hits business-focused sites hardest.
Technical information
The vulnerability is in how the Reveal Listing plugin handles user registration. The plugin reads a listing_user_role field from the registration request and applies no server-side validation or restriction to it. An attacker can submit a registration form or HTTP request with listing_user_role=administrator (or any other privileged role), and the plugin creates the new user with that role, administrator included. All normal WordPress role assignment controls are bypassed.
- No authentication is required for this attack
- The only requirement is access to the registration endpoint
- The flaw is classified as CWE-269 (Improper Privilege Management)
No public code snippets are available, but multiple security advisories confirm the mechanism. The attack needs no special tools, only the ability to send HTTP POST requests.
Affected systems and versions
- Product: Reveal Listing plugin for WordPress
- Vendor: SmartDataSoft
- Affected versions: Up to and including 3.3
- All configurations where public registration is enabled are vulnerable
Vendor security history
There is no public record of earlier vulnerabilities this severe in SmartDataSoft's products. As of the publication date, the vendor has not published a patch or advisory. The available information is not enough to judge its response time or security maturity.
