Introduction
Attackers can register as administrators on vulnerable WordPress sites running the Reveal Listing plugin. This critical flaw in the registration process enables complete site takeover with minimal effort. For organizations using directory or listing features powered by this plugin, the risk is immediate and severe.
About the involved software: Reveal Listing is a commercial WordPress plugin by SmartDataSoft, distributed via ThemeForest. It is designed for building directory and listing sites and is used by a range of small and medium businesses. Its presence in the WordPress ecosystem makes vulnerabilities in this plugin highly impactful for business-focused sites.
Technical Information
The vulnerability is rooted in the way the Reveal Listing plugin handles user registration. Specifically, the plugin processes a listing_user_role field from the registration request. There is no server-side validation or restriction on this field, so an attacker can submit a registration form or HTTP request with listing_user_role=administrator (or any other privileged role). The plugin then creates the new user with the specified role, including administrator, bypassing all normal WordPress role assignment controls.
- No authentication is required for this attack
- The only requirement is access to the registration endpoint
- The flaw is classified as CWE-269 (Improper Privilege Management)
No public code snippets are available, but the mechanism is confirmed by multiple security advisories. The attack does not require any special tools beyond the ability to send HTTP POST requests.
Affected Systems and Versions
- Product: Reveal Listing plugin for WordPress
- Vendor: SmartDataSoft
- Affected versions: Up to and including 3.3
- All configurations where public registration is enabled are vulnerable
Vendor Security History
There is no public record of previous vulnerabilities of this severity in SmartDataSoft's products. The vendor has not published a patch or advisory as of the publication date. Their response time and security maturity cannot be assessed from available information.