5.9
Moyenne
CVE-2026-106646 The Classified Listing WordPress plugin before 6.1.1 does not verify that the requester owns or can edit the target…
Description
The Classified Listing WordPress plugin before 6.1.1 does not verify that the requester owns or can edit the target listing when a gallery request references an unattached media item, allowing any authenticated user with a subscriber-level account to modify, corrupt or delete media-library attachments owned by other users, including administrators.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Classified Listing 6.1 | premières → < 6.1.1 | 6.1.1 |
Autres CVE de Classified Listing
Les 5 CVE de Classified Listing →
CVE-2026-16281
The Classified Listing WordPress plugin before 6.1.1 does not verify that the caller owns or can edit the target…
7.1
Élevée
CVE-2026-16276
The Classified Listing WordPress plugin before 5.4.4 does not perform a capability check on an AJAX action that returns…
2.7
Faible
CVE-2026-16274
The Classified Listing WordPress plugin before 5.4.4 does not perform a capability or ownership check on an AJAX action…
2.7
Faible
CVE-2026-14183
The Classified Listing WordPress plugin before 5.3.9 does not verify that the order targeted by its payment-receipt…
4.3
Moyenne