7.1
High
CVE-2026-16281 The Classified Listing WordPress plugin before 6.1.1 does not verify that the caller owns or can edit the target…
Description
The Classified Listing WordPress plugin before 6.1.1 does not verify that the caller owns or can edit the target listing before its AI image-editing AJAX action deletes or attaches media, allowing any authenticated user, including a subscriber, to permanently delete attachments from, and attach files to, any listing owned by another user.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Classified Listing 5.3 | 5.3.0 → < 6.1.1 | 6.1.1 |
Other CVEs of Classified Listing
The 5 CVEs of Classified Listing →
CVE-2026-106646
The Classified Listing WordPress plugin before 6.1.1 does not verify that the requester owns or can edit the target…
5.9
Medium
CVE-2026-16276
The Classified Listing WordPress plugin before 5.4.4 does not perform a capability check on an AJAX action that returns…
2.7
Low
CVE-2026-16274
The Classified Listing WordPress plugin before 5.4.4 does not perform a capability or ownership check on an AJAX action…
2.7
Low
CVE-2026-14183
The Classified Listing WordPress plugin before 5.3.9 does not verify that the order targeted by its payment-receipt…
4.3
Medium