What is the CVSS score of CVE-2026-42651?

CVE-2026-42651 has a CVSS 3.1 base score of 6.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Classified Listing CVE-2026-42651

EUVD-2026-36819 MEDIUM

Missing Authorization (CWE-862)

2026-06-15 Patchstack

GHSA-rh97-2gq2-wwv2

Authentication Bypass Classified Listing

6.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

vuln.today AI

6.3 MEDIUM

Network-accessible WordPress plugin requiring only subscriber authentication (PR:L) with low complexity; no scope change and low partial impacts across all three dimensions.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 23:03 vuln.today

DescriptionCVE.org

Subscriber Broken Access Control in Classified Listing <= 5.3.9 versions.

AnalysisAI

Broken access control in the Classified Listing WordPress plugin (versions ≤ 5.3.9) allows subscriber-level authenticated users to perform actions that should be restricted to higher-privileged roles, yielding partial confidentiality, integrity, and availability impact. Reported by Patchstack and tracked under ENISA EUVD-2026-36819, the flaw stems from missing authorization checks (CWE-862) within plugin functionality accessible to the lowest default WordPress user role. No public exploit identified at time of analysis, and this vulnerability has not been added to the CISA KEV catalog.

Technical ContextAI

The vulnerability is rooted in CWE-862 (Missing Authorization), meaning the Classified Listing plugin fails to enforce role-based access controls before executing sensitive operations. In WordPress, the 'Subscriber' role is the least privileged authenticated role, typically only able to read content and manage their own profile. When a plugin neglects server-side authorization checks on privileged endpoints or AJAX actions, a subscriber can invoke those functions directly via crafted HTTP requests - bypassing the intended UI restrictions. The affected product is identified by CPE cpe:2.3:a:mamunur_rashid:classified_listing:*:*:*:*:*:*:*:*, covering all releases through 5.3.9. The CVSS vector AV:N/AC:L/PR:L reflects that the flaw is network-reachable with low complexity and requires only a low-privilege account.

RemediationAI

The primary remediation is to update the Classified Listing plugin to a version beyond 5.3.9 via the WordPress plugin dashboard or by downloading the latest release from the plugin repository. The Patchstack advisory (https://patchstack.com/database/wordpress/plugin/classified-listing/vulnerability/wordpress-classified-listing-plugin-5-3-9-broken-access-control-vulnerability) and the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-42651) should be monitored for confirmation of the specific patched version. A released patched version is not independently confirmed from the available data. As a compensating control prior to patching, site administrators should disable open user registration if not operationally required, which eliminates the ability of unknown parties to self-provision the subscriber role needed for exploitation. If the plugin's affected functionality can be identified, restricting access to specific plugin pages or AJAX endpoints via a WAF rule is a viable interim measure, though this may impact legitimate subscriber-level features.