What’s Vulnerable › Vulnerabilities

CVE-2022-3921: Listingo < 3.2.7 - Unauthenticated Arbitrary File Upload

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 21.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-12-12 · updated 2026-06-17

Description

The Listingo WordPress theme before 3.2.7 does not validate files to be uploaded via an AJAX action available to unauthenticated users, which could allow them to upload arbitrary files and lead to RCE

Affected products

• Listingo: before 3.2.7 — fixed in 3.2.7

How to fix

Upgrade to a fixed version: Listingo 3.2.7. Check the vendor advisory for mitigations.

References

• https://wpscan.com/vulnerability/e39b59b0-f24f-4de5-a21c-c4de34c3a14f
• https://wpscan.com/vulnerability/e39b59b0-f24f-4de5-a21c-c4de34c3a14f

Get alerted when CVE-2022-3921 or the next vulnerability affects your stack