What is the CVSS score of EUVD-2026-41354?

EUVD-2026-41354 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.3%.

Classified Listing EUVD-2026-41354

| CVE-2026-57355 MEDIUM

Missing Authorization (CWE-862)

2026-07-02 Patchstack

GHSA-h46g-h6w4-h868

WordPress Authentication Bypass Classified Listing Wordpress Plugin Radiustheme

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

6.5 MEDIUM

Network-exploitable with low complexity; PR:L reflects mandatory subscriber authentication; I:H for unauthorized data modification; no confidentiality or availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 12:35 vuln.today

DescriptionCVE.org

Subscriber Broken Access Control in Classified Listing <= 5.4.2 versions.

AnalysisAI

Broken access control in the Classified Listing WordPress plugin (versions <= 5.4.2) allows subscriber-level authenticated users to perform privileged actions they should not be authorized to execute, resulting in high integrity impact. The vulnerability stems from missing authorization checks (CWE-862) on one or more plugin endpoints or AJAX handlers, enabling low-privilege WordPress users to manipulate listing data, settings, or administrative functions beyond their intended role. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and network accessibility make this a realistic threat on any affected WordPress installation.

Technical ContextAI

Classified Listing is a WordPress plugin developed by RadiusTheme (CPE: cpe:2.3:a:radiustheme:classified_listing:*:*:*:*:*:*:*:*) used to build classified advertisement and directory listing websites. CWE-862 (Missing Authorization) indicates that the plugin exposes one or more server-side actions - likely WordPress AJAX actions, REST API endpoints, or form handlers - without verifying that the requesting user holds the appropriate capability for the operation. In WordPress, the subscriber role is the lowest authenticated role by default, with no content management privileges. The absence of nonce verification or capability checks (e.g., current_user_can()) on privileged actions allows this role to escalate its effective permissions within the plugin's feature set. The CVSS vector confirms the flaw is network-accessible, requires no elevated privileges beyond a basic subscriber account, and produces high integrity impact with no confidentiality or availability component.

RemediationAI

The primary fix is to update the Classified Listing plugin to the version released after 5.4.2, which should include the missing authorization checks. Consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/classified-listing/vulnerability/wordpress-classified-listing-plugin-5-4-2-broken-access-control-vulnerability for the confirmed patched version, as the exact fix version is not specified in the available input data. As a compensating control prior to patching, administrators should disable open subscriber self-registration under WordPress Settings > General by unchecking 'Anyone can register', which raises the effective attack requirement from PR:L to PR:H by blocking unauthenticated account creation. This reduces exposure but does not eliminate the flaw for existing low-privilege accounts. Additionally, review and audit existing subscriber-level accounts for any unauthorized changes to listing data or plugin settings. The Patchstack Firewall virtual patch may provide interim protection for Patchstack-enrolled sites.