uListing < 1.7 - Unauthenticated Arbitrary Account Change

The AJAX action stm_listing_profile_edit() accessible to both authenticated and unauthenticated users did not perform capability and CSRF checks, and did not ensure that the edited account belonged to the user making the request. This allows unauthenticated users to update arbitrary accounts, such as changing their email addresses or profile picture