Reveal Listing WordPress Plugin Privilege Escalation Vulnerability

A privilege escalation vulnerability exists in the Reveal Listing plugin by SmartDataSoft for WordPress, affecting versions through 3.3. The vulnerability arises because the plugin allows users registering new accounts to choose their own roles by using the 'listing_user_role' field. This functionality can be exploited by unauthenticated attackers to create accounts with administrative privileges.

Impact

Exploitation of this vulnerability allows unauthenticated users to gain administrative privileges on the WordPress site.

Remediation

Users are advised to update the Reveal Listing WordPress plugin to version 3.4 or a newer patched version.