CVE-2025-63039

The ListingPro WordPress theme, versions up to and including 2.9.9, is affected by a missing authorization vulnerability. This flaw stems from incorrectly configured access control security levels, which can be exploited by attackers to perform actions that should require higher privileges. [1]

Attackers can exploit this vulnerability without needing any prior authentication or special access, making it possible to target thousands of websites in mass-exploit campaigns. The vulnerability is considered moderately dangerous and is expected to become actively exploited. [1]

Successful exploitation could allow an attacker to bypass intended access restrictions and perform unauthorized actions on the affected site. This could include modifying content, accessing sensitive data, or other administrative operations depending on the specific broken access control issue. [1]

Immediate action is recommended by updating the ListingPro theme to a patched version. If updating is not possible, site owners should consult their hosting provider or web developer for alternative security measures. The vulnerability has been publicly disclosed and is flagged as likely to be targeted by mass exploitation. [1]