CVE-2021-36879: 
WordPress vulnerability analysis and mitigation

An unauthenticated privilege escalation vulnerability was discovered in WordPress uListing plugin versions 2.0.5 and earlier. The vulnerability is tracked as CVE-2021-36879 and was reported by Patchstack. The vulnerability could be exploited if the WordPress configuration allows user registration (Patchstack Advisory).

The vulnerability received a CVSS v3.1 base score of 9.8 (CRITICAL) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. This indicates that the vulnerability can be exploited remotely without requiring privileges or user interaction, and potentially impacts all aspects of security - confidentiality, integrity, and availability (NVD).

If successfully exploited, this vulnerability could allow an unauthenticated attacker to escalate their privileges to a higher level, potentially gaining administrative access to the WordPress installation. This could lead to full control of the affected website if high privileges are obtained (Patchstack Advisory).

The vulnerability is considered highly dangerous and was expected to become mass exploited. It requires no authentication and can be exploited remotely if the WordPress site has user registration enabled (Patchstack Advisory).

The vulnerability was fixed in version 2.0.6 of the uListing plugin. Site administrators are strongly advised to update to version 2.0.6 or later to resolve this security issue (Patchstack Advisory).