CVE-2025-69191: 
WordPress vulnerability analysis and mitigation

CVE-2025-69191 is a Missing Authorization vulnerability in the e-plugins ListingHub WordPress plugin that allows unauthenticated remote attackers to exploit incorrectly configured access control security levels. It affects ListingHub versions from n/a through 1.2.7 (inclusive). The vulnerability was published on January 22, 2026, and assigned a CVSS v3.1 base score of 7.3 (High) by CISA-ADP (Feedly, Patchstack).

The root cause is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether a requesting user has the necessary permissions before executing sensitive operations. Because no authentication or capability checks are enforced on affected endpoints, a remote, unauthenticated attacker can directly invoke restricted plugin functionality. The vulnerability was discovered and reported by Patchstack, which assigned it the alias GHSA-466m-cgr3-wmg5 (Feedly, Patchstack).

Successful exploitation results in low-level impacts across confidentiality, integrity, and availability — an attacker can read limited sensitive data, modify plugin-managed content or settings, and cause minor disruption to plugin functionality. Because no authentication is required, any internet-facing WordPress site running ListingHub ≤ 1.2.7 is exposed. While the individual impact per metric is rated low, the combination and lack of authentication prerequisites make this a meaningful risk for affected sites (Feedly).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for CVE-2025-69191. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been identified (Feedly).

Users should update the ListingHub WordPress plugin to a version beyond 1.2.7 as soon as a patched release is made available by e-plugins. In the interim, site administrators should consider deactivating or removing the plugin if it is not critical to operations. Restricting access to WordPress admin and plugin endpoints via web application firewall (WAF) rules can provide additional defense-in-depth (Patchstack).