5.9
Medium
CVE-2026-106646 The Classified Listing WordPress plugin before 6.1.1 does not verify that the requester owns or can edit the target…
Description
The Classified Listing WordPress plugin before 6.1.1 does not verify that the requester owns or can edit the target listing when a gallery request references an unattached media item, allowing any authenticated user with a subscriber-level account to modify, corrupt or delete media-library attachments owned by other users, including administrators.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Classified Listing 6.1 | earliest → < 6.1.1 | 6.1.1 |
Other CVEs of Classified Listing
The 5 CVEs of Classified Listing →
CVE-2026-16281
The Classified Listing WordPress plugin before 6.1.1 does not verify that the caller owns or can edit the target…
7.1
High
CVE-2026-16276
The Classified Listing WordPress plugin before 5.4.4 does not perform a capability check on an AJAX action that returns…
2.7
Low
CVE-2026-16274
The Classified Listing WordPress plugin before 5.4.4 does not perform a capability or ownership check on an AJAX action…
2.7
Low
CVE-2026-14183
The Classified Listing WordPress plugin before 5.3.9 does not verify that the order targeted by its payment-receipt…
4.3
Medium