What is the CVSS score of CVE-2026-7563?

CVE-2026-7563 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Classified Listing WordPress Plugin CVE-2026-7563

EUVD-2026-30519 MEDIUM

Missing Authorization (CWE-862)

2026-05-15 Wordfence

GHSA-wh75-4gj8-68pm

WordPress Authentication Bypass Wordpress Plugin Classified Listing Ai Powered Classified Ads Business Directory Plugin

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 15, 2026 - 09:32 vuln.today

CVE Published

May 15, 2026 - 08:27 nvd

MEDIUM 4.3

DescriptionCVE.org

The Classified Listing - AI-Powered Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 5.3.10. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to add arbitrary notes to any order and trigger unsolicited notification and moderation emails to listing owners without administrative authorization.

AnalysisAI

Authenticated attackers with subscriber-level access can add arbitrary notes to any order in the Classified Listing - AI-Powered Classified ads & Business Directory Plugin (all versions up to 5.3.10) due to missing authorization checks, triggering unsolicited notification and moderation emails to listing owners. The plugin fails to verify user permissions before allowing note creation, enabling privilege escalation within WordPress installations where subscriber accounts exist. No public exploit code or active exploitation has been identified at the time of analysis.

Technical ContextAI

The vulnerability exists in the plugin's note-addition functionality, specifically within the Comments.php and ListingAdminAjax.php controllers, which handle user-triggered actions without proper authorization verification. The root cause is classified as CWE-862 (Missing Authorization), indicating the plugin does not implement role-based access control checks before executing order-note operations. The affected component processes Ajax requests and comment hooks that should be restricted to order owners or administrators but are instead accessible to any authenticated user with subscriber-level permissions or above. WordPress uses the current_user_can() function to verify capabilities; the plugin's failure to use such checks allows subscriber accounts to bypass intended access restrictions and manipulate order data and notifications.

RemediationAI

Update the Classified Listing plugin to the latest patched version immediately; plugin developers are expected to release version 5.3.11 or later with proper authorization checks. No specific fixed version is confirmed in the provided data, so contact the plugin vendor (TechLabPro1) or monitor the plugin repository for security updates. Until a patch is released, administrators should restrict subscriber-level access to users who are fully trusted, use WordPress role-management plugins to prevent subscriber account creation, or temporarily disable the classified listings feature if not critical to operations. Audit all orders created since the plugin was installed to identify any unauthorized notes added by non-admin accounts. Review WordPress access logs and plugin activity logs for evidence of exploitation. As a temporary workaround, use custom code to enforce authorization checks in the Comments.php and ListingAdminAjax.php controllers, but this is not a long-term solution and may break on plugin updates. Reference the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/07cb3d57-d768-49a5-8af0-9dc4384487d5 and monitor the WordPress plugin repository changeset at https://plugins.trac.wordpress.org/changeset/3527717/ for patch availability.