What is the CVSS score of EUVD-2026-104323?

EUVD-2026-104323 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Classified Listing EUVD-2026-104323

| CVE-2026-111828 MEDIUM

Improper Validation of Specified Quantity in Input (CWE-1284)

2026-10-19 Patchstack

GHSA-r7h4-c665-888x

WordPress Information Disclosure Classified Listing Wordpress Plugin Mamunur Rashid

4.3

CVSS 3.1 · Vendor: Patchstack

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Authenticate as low-privilege WordPress user
Exploit

Send crafted request to unconstrained plugin endpoint
Execution

Bypass missing ACL check
Impact

Access restricted functionality/data

Vulnerability Assessment

Weakness	CWE CWE-1284 ASVS 5.0 V2 - Validation and Business Logic Input size validation
Exploitation Conditions	Requires a valid authenticated WordPress account with at least low privileges (CVSS PR:L) on a site running the Classified Listing plugin at version 6.1.5 or earlier; no victim user interaction is needed (UI:N) and the flaw is reachable remotely over the network (AV:N). The limiting factor is the authentication requirement - an attacker must already be able to log in (e.g. via open user registration, which many classifieds sites enable) - and the impact is confined to accessing functionality/information not properly constrained by ACLs, with no write or availability consequences.
Impact	This is a genuinely low-priority issue despite being a network-reachable flaw. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base 4.3 Medium) shows the only impact is a partial confidentiality loss (C:L) with no integrity or availability effect, and exploitation requires an existing authenticated account (PR:L) - consistent with a broken-access-control/information-disclosure weakness (CWE-1284) where a low-privilege user reaches functionality not properly constrained by ACLs. No EPSS score, CISA KEV listing, or public POC was provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. One signal conflicts: the Patchstack reference slug labels this a 'direct static code injection vulnerability,' which would normally imply integrity/code-execution impact, yet the official description and CVSS describe only ACL-bypass information disclosure with I:N and A:N - this discrepancy should be verified with Patchstack/the vendor, but on the authoritative CVSS and description data the real-world risk is modest: an authenticated low-privilege user can view or reach data/functions they should not, not take over the site.
Exploit ScenarioDerived	A low-privilege authenticated user of a WordPress site running Classified Listing (e.g. a registered subscriber or listing author) sends a crafted request to a plugin endpoint whose access controls are missing or improperly enforced, gaining access to functionality or information reserved for higher-privilege roles. Impact is limited to disclosure of restricted data (CVSS C:L, no integrity/availability effect); no public exploit code is identified at time of analysis.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

No patch listed yet 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Oct 19, 2026

Classified Listing, a WordPress classifieds plugin, through version 6.1.5 does not properly validate a specified quantity in input, allowing low-privileged authenticated users to reach functionality that ACLs should restrict and to read limited information (CVSS 4.3, confidentiality-only impact). The flaw is remotely reachable without user interaction but requires a logged-in account, such as one created through open registration commonly enabled on classifieds sites. No public exploit code or CISA KEV entry was identified at time of analysis.

RemediationAI

No exact vendor-released fixed version is specified in the provided data; the authoritative reference is the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/classified-listing/vulnerability/wordpress-classified-listing-plugin-6-1-5-direct-static-code-injection-vulnerability?_s_id=cve, so administrators should check that entry and the plugin vendor for an update that supersedes 6.1.5 and apply it when available. Until a fixed release is confirmed, reduce exposure by disabling open user registration where operationally possible so unauthenticated outsiders cannot obtain the low-privileged accounts required for exploitation, and audit existing low-privilege roles to remove unnecessary accounts; the trade-off is reduced self-service signup. Restrict access to Classified Listing plugin endpoints and administrative functionality to trusted roles, and consider a WAF or virtual patching rule that targets the affected plugin routes if one is available, recognizing that such rules can cause false positives on legitimate classifieds workflows. Because exploitation requires only a valid low-privileged account and no user interaction, monitoring for unusual access to restricted plugin functionality by low-privilege users is also warranted.

Affected VersionsENISA

Classified Listing 0 ≤6.1.5

Affected Packages

euvd classified_listing no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The issue is a WordPress plugin ACL/authorization weakness classified as CWE-1284, Improper Validation of Specified Quantity in Input. In affected Classified Listing releases through 6.1.5, a quantity-type input is not adequately validated before being used in a security-relevant decision, so a low-privileged authenticated user can invoke functionality that should be constrained by access-control checks. The CPE cpe:2.3:a:mamunur_rashid:classified_listing:*:*:*:*:*:*:*:* identifies the Mamunur Rashid Classified Listing WordPress plugin as the affected component. The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N confirms network reachability, low attack complexity, an authenticated low-privilege prerequisite, no user interaction, unchanged scope, and limited confidentiality impact with no integrity or availability effect. The Patchstack reference is a WordPress plugin vulnerability database entry, and the weakness is best understood as an ACL bypass/information disclosure class rather than code execution or data modification.

Know when Classified Listing gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Patchstack) PRIMARY 4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI 4.3 MEDIUM

Remote low-privilege authenticated user (PR:L) bypasses missing ACLs with no user interaction, yielding only limited data disclosure (C:L), so I and A are N.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

DescriptionCVE.org

Improper Validation of Specified Quantity in Input vulnerability in Mamunur Rashid Classified Listing classified-listing allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Classified Listing: from n/a through 6.1.5.

Threat Intelligence Overview

EPSS Score

0.2%

Top 89% exploitable

Prevalence

Medium

popular WordPress classifieds plugin, common but not on most sites

Social Media

Sightings

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment CIRCL

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC No

EPSS 0.2%

Patch available No

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Human Impact· derived

Medium

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +22

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.