CVE-2025-12574: 
WordPress vulnerability analysis and mitigation

CVE-2025-12574 is a Missing Authorization vulnerability in the Listar – Directory Listing & Classifieds WordPress Plugin that allows authenticated attackers with Subscriber-level access or above to delete arbitrary posts. The flaw affects all versions of the plugin up to and including 3.0.0, developed by passionui. It was published on December 6, 2025, and assigned a CVSS v3.1 base score of 4.3 (Medium) (Wordfence, Red Hat CVE).

The root cause is a missing capability check (CWE-862) on the /wp-json/listar/v1/place/delete REST API endpoint. Because the endpoint does not verify whether the requesting user has sufficient privileges to perform deletion operations, any authenticated user — including those with the lowest default WordPress role (Subscriber) — can send a DELETE request targeting arbitrary post IDs. No special configuration or elevated permissions are required beyond a valid authenticated session (Wordfence, ENISA EUVD).

Successful exploitation allows low-privileged authenticated users to permanently delete arbitrary posts on the affected WordPress site, resulting in unauthorized data loss and integrity degradation. While confidentiality and availability are not directly impacted per the CVSS scoring, mass deletion of listings or classified ads could effectively disrupt site functionality and destroy business-critical content. The impact is limited to sites running the Listar plugin up to version 3.0.0 (Wordfence, ENISA EUVD).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-12574. The EPSS score is approximately 0.026% (0.000260), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires only a valid authenticated account at Subscriber level or above, making it accessible to any registered user on an affected site (Wordfence, Red Hat CVE).

1. Reconnaissance: Identify WordPress sites running the Listar – Directory Listing & Classifieds plugin (version ≤ 3.0.0) by checking plugin metadata via /wp-content/plugins/listar-directory-listing/ or using tools like WPScan.
2. Obtain authenticated access: Register or log in to the target WordPress site with any account at Subscriber level or above (e.g., a free user registration if open registration is enabled).
3. Identify target post IDs: Browse the site's directory listings or classifieds to enumerate post IDs of content to be deleted (visible in URLs or page source).
4. Send DELETE request: Issue an authenticated HTTP DELETE or POST request to the vulnerable REST API endpoint: POST /wp-json/listar/v1/place/delete with the target post ID in the request body, including the WordPress authentication nonce or cookie.
5. Confirm deletion: Verify that the targeted post has been removed from the site, confirming successful exploitation of the missing authorization check (Wordfence).

• Logs: WordPress access logs showing repeated authenticated requests to /wp-json/listar/v1/place/delete from a single low-privileged user account, especially targeting multiple different post IDs in a short timeframe.
• Logs: WordPress debug or error logs recording unexpected post deletion events initiated by Subscriber-level users.
• Application: Sudden disappearance of multiple directory listings or classified ad posts without corresponding admin activity in the WordPress admin audit trail.
• Network: Unusual REST API traffic patterns targeting the Listar plugin endpoint from authenticated sessions that do not correspond to normal editorial workflows.

Site administrators should update the Listar – Directory Listing & Classifieds WordPress Plugin to a version beyond 3.0.0 if a patched release becomes available from the vendor (passionui). As an interim workaround, administrators can disable open user registration to prevent untrusted users from obtaining Subscriber-level accounts, or use a WordPress security plugin (e.g., Wordfence) to block unauthorized REST API access. Monitoring the WordPress REST API logs for suspicious DELETE requests to the Listar endpoint is also recommended (Wordfence, WordPress Plugin Page).