EUVD-2026-70900
GHSA-p9w8-7wph-h4x9
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
Subscriber-level account sufficient (PR:L); network-accessible AJAX endpoint (AV:N); no confidentiality leak; integrity high from cross-user media manipulation; availability low from attachment deletion only.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
7DescriptionCVE.org
The Classified Listing WordPress plugin before 6.1.1 does not verify that the caller owns or can edit the target listing before its AI image-editing AJAX action deletes or attaches media, allowing any authenticated user, including a subscriber, to permanently delete attachments from, and attach files to, any listing owned by another user.
AnalysisAI
Broken object-level authorization in the Classified Listing WordPress plugin (versions 5.3.0 through pre-6.1.1) allows any authenticated subscriber-level user to permanently delete media attachments from, or attach arbitrary files to, listings owned by other users by invoking the plugin's AI image-editing AJAX action with a victim's listing ID. The handler performs no ownership or capability verification before acting on the supplied identifier (CWE-639), meaning the lowest default WordPress role is sufficient to tamper with any listing on the platform. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid WordPress account at subscriber level or above - the lowest authenticated role that WordPress assigns by default. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L (score 7.1) is well-calibrated: the attack is network-reachable, requires no complexity, and a subscriber account is the only credential needed. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the Classified Listing WordPress plugin to version 6.1.1 or later, which introduces the missing ownership and capability checks in the AI image-editing AJAX handler. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all WordPress installations using Classified Listing plugin and determine which versions are deployed-prioritize instances in versions 5.3.0 through 6.1.0. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Classified Listing
View allThe Classified Listing Pro WordPress plugin before 2.0.20 does not escape a generated URL before outputting it back in a
The Classima WordPress theme before 2.1.11 and some of its required plugins (Classified Listing before 2.2.14, Classifie
The Classified Listing - Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to Cross-Site Req
Cross-Site Request Forgery (CSRF) vulnerability in RadiusTheme Classified Listing plugin <= 2.4.5 versions. Rated high s
Insecure Direct Object Reference (IDOR) in the Classified Listing WordPress plugin before 5.3.9 exposes payment receipt
Cross-site scripting in the Classified Listing WordPress plugin (by RadiusTheme) versions 5.4.2 and earlier lets a remot
Unauthenticated reflected/stored Cross-Site Scripting in the Classified Listing WordPress plugin versions 5.3.8 and earl
Unauthorized revenue data disclosure in the Classified Listing WordPress plugin (before 5.4.4) allows any authenticated
The Classified Listing WordPress plugin before version 5.4.4 exposes private, draft, and pending post content to authent
The Classified Listing - Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to unauthorized a
Path traversal in the Classified Listing WordPress plugin (versions through 5.3.8) enables authenticated low-privileged
Broken access control in the Classified Listing WordPress plugin (versions <= 5.4.2) allows subscriber-level authenticat
Share
External POC / Exploit Code
Leaving vuln.today