What is the CVSS score of CVE-2026-42640?

CVE-2026-42640 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Classified Listing CVE-2026-42640

EUVD-2026-36816 MEDIUM

Missing Authorization (CWE-862)

2026-06-15 Patchstack

GHSA-3w93-f425-v54j

Authentication Bypass Classified Listing

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

6.5 MEDIUM

Network-reachable unauthenticated endpoint with no complexity or interaction; impact bounded to partial listing data read and write, no availability or scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 23:03 vuln.today

DescriptionCVE.org

Unauthenticated Broken Access Control in Classified Listing <= 5.3.8 versions.

AnalysisAI

Broken Access Control in the Classified Listing WordPress plugin (versions ≤ 5.3.8) allows unauthenticated remote attackers to bypass authorization checks, enabling limited read and write access to plugin-managed listing data without any credentials. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms the flaw is network-exploitable against any internet-exposed WordPress installation running the affected plugin with no authentication or user interaction required. No public exploit code or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

The Classified Listing plugin (CPE: cpe:2.3:a:mamunur_rashid:classified_listing) is a WordPress plugin for creating and managing classified advertisement listings. The root cause is CWE-862 (Missing Authorization), meaning one or more plugin endpoints - typically WordPress REST API routes or admin-ajax.php handlers - fail to verify whether the requesting party holds the capability required to perform the action. WordPress plugins commonly register custom action hooks or REST controllers; when these omit proper capability checks (such as current_user_can()), any unauthenticated HTTP client can invoke what should be privileged functionality. The CVSS PR:N and AC:L metrics confirm exploitation is straightforward and requires no pre-established trust, session token, or special network position.

RemediationAI

Update the Classified Listing WordPress plugin to a version beyond 5.3.8; however, no specific patched release number is confirmed in the available input data, so administrators must verify the exact fixed version via the WordPress.org plugin repository or the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/classified-listing/vulnerability/wordpress-classified-listing-plugin-5-3-8-broken-access-control-vulnerability before deploying. If an immediate update is not feasible, temporarily deactivating the plugin eliminates the attack surface entirely, at the cost of removing all classified listing functionality from the site. As a partial compensating control, deploying a web application firewall (WAF) with rules blocking unauthorized requests to the plugin's AJAX or REST endpoints may reduce exposure, though the specific vulnerable endpoint names are not confirmed in available data and WAF coverage may be incomplete - do not treat WAF filtering as equivalent to patching.