EUVD-2026-69945
GHSA-gh5v-3gj8-m99h
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Requires a valid low-privilege account (PR:L); no confidentiality impact; integrity and availability limited to plugin data scope.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Missing Authorization vulnerability in Mamunur Rashid Classified Listing allows Accessing Functionality Not Properly Constrained by ACLs.
This issue affects Classified Listing: from n/a through 6.1.1.
AnalysisAI
Missing authorization in the Classified Listing WordPress plugin (≤6.1.1) allows authenticated low-privileged users to invoke restricted plugin functionality without the required capability checks. Reported by Patchstack with a CVSS 5.4 medium score, the flaw falls under CWE-862 (Missing Authorization), meaning the plugin fails to verify whether the requesting user holds the appropriate ACL permissions before executing sensitive actions. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid low-privilege WordPress account on the target site (e.g., Subscriber, Customer, or any role the site grants upon free registration). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS base score of 5.4 (Medium) is consistent with the actual risk profile: network-reachable (AV:N), low complexity (AC:L), but constrained by the need for a valid low-privilege account (PR:L) and limited impact (C:N/I:L/A:L). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the Classified Listing plugin to a version beyond 6.1.1 - the exact patched release version is not independently confirmed in the available data, so consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/classified-listing/vulnerability/wordpress-classified-listing-plugin-6-1-1-broken-access-control-vulnerability) and the WordPress plugin repository for the current release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Classified Listing
View allBroken object-level authorization in the Classified Listing WordPress plugin (versions 5.3.0 through pre-6.1.1) allows a
The Classified Listing Pro WordPress plugin before 2.0.20 does not escape a generated URL before outputting it back in a
The Classima WordPress theme before 2.1.11 and some of its required plugins (Classified Listing before 2.2.14, Classifie
The Classified Listing - Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to Cross-Site Req
Cross-Site Request Forgery (CSRF) vulnerability in RadiusTheme Classified Listing plugin <= 2.4.5 versions. Rated high s
Insecure Direct Object Reference (IDOR) in the Classified Listing WordPress plugin before 5.3.9 exposes payment receipt
Cross-site scripting in the Classified Listing WordPress plugin (by RadiusTheme) versions 5.4.2 and earlier lets a remot
Unauthenticated reflected/stored Cross-Site Scripting in the Classified Listing WordPress plugin versions 5.3.8 and earl
Unauthorized revenue data disclosure in the Classified Listing WordPress plugin (before 5.4.4) allows any authenticated
The Classified Listing WordPress plugin before version 5.4.4 exposes private, draft, and pending post content to authent
The Classified Listing - Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to unauthorized a
Path traversal in the Classified Listing WordPress plugin (versions through 5.3.8) enables authenticated low-privileged
Same weakness CWE-862 – Missing Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today