Classified Listing CVE-2026-106646

Requires an authenticated subscriber-level account on the target site (PR:L), so exploitation is realistic mainly where open user registration is enabled - a common default for classifieds sites using this plugin. The flaw is specifically triggered when a gallery request references an UNATTACHED media-library item: the plugin fails to verify the requester owns or can edit that attachment. Limiting factors that reduce real-world risk: the need for a valid account, the AC:H condition that the targeted media be in the unattached state and reachable via the gallery request, and the integrity/availability-only impact (no data disclosure, C:N). Sites that disable self-registration or restrict subscriber creation substantially narrow the attack surface.

Signals are consistent and point to a moderate, not top-tier, priority. The provided CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L, base 5.9) describes a network-reachable but authenticated (PR:L, subscriber-level) authorization flaw with high attack complexity and no confidentiality impact - integrity-focused, with limited availability impact. EPSS is low at 0.17% (6th percentile) and CISA SSVC rates Exploitation: none, Automatable: no, Technical Impact: partial, all of which argue against imminent mass exploitation. The one elevating signal is that public exploit code exists (WPScan), but this is POC availability, not confirmed active exploitation - it is NOT in CISA KEV. The AC:H and PR:L requirements (attacker must hold a valid subscriber account and the attack hinges on the specific unattached-media condition) materially cap real-world risk despite the network vector. No conflicting signals are present: the low EPSS, 'Exploitation: none' SSVC, and absence from KEV all align, while POC availability raises residual exploitability. Net: a legitimate flaw worth patching on normal cadence, not an emergency.

An attacker self-registers (or uses any existing subscriber-level account) on a WordPress site running Classified Listing below 6.1.1, then submits a listing gallery request that references a media-library attachment ID belonging to another user, such as an administrator. Because the plugin never checks that the requester owns or can edit the referenced unattached media, the attacker can modify, corrupt or delete those attachments. A public proof-of-concept is documented by WPScan, lowering the skill barrier.