Input validation vulnerability in Directory Listings WordPress plugin – uListing 2.2.0

The Directory Listings WordPress plugin, also known as uListing plugin, has a security vulnerability in all versions up to and including 2.2.0. This vulnerability allows attackers with at least Subscriber-level access to inject a PHP Object through untrusted input. The impact of this vulnerability is limited unless there is another plugin or theme on the website that contains a specific type of code called a POP chain. If a POP chain is present, the attacker may be able to delete files, access sensitive information, or run code on the website.