Ultimate Classified Listings WordPress Plugin Cross-Site Request Forgery Vulnerability

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the Ultimate Classified Listings plugin for WordPress, affecting all versions through 1.5. The issue arises from inadequate nonce validation in the 'update_profile' function, allowing unauthenticated attackers to alter a user's email address via a fake request. This could potentially lead to account takeover if the attacker can persuade the user to click a link or perform a similar action.

Impact

Exploitation of this vulnerability could result in unauthorized email changes, potentially allowing attackers to take over user accounts.

Remediation

Users are advised to update the Ultimate Classified Listings plugin to version 1.6 or later.