7.1
Élevée
CVE-2026-16281 The Classified Listing WordPress plugin before 6.1.1 does not verify that the caller owns or can edit the target…
Description
The Classified Listing WordPress plugin before 6.1.1 does not verify that the caller owns or can edit the target listing before its AI image-editing AJAX action deletes or attaches media, allowing any authenticated user, including a subscriber, to permanently delete attachments from, and attach files to, any listing owned by another user.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Classified Listing 5.3 | 5.3.0 → < 6.1.1 | 6.1.1 |
Autres CVE de Classified Listing
Les 5 CVE de Classified Listing →
CVE-2026-106646
The Classified Listing WordPress plugin before 6.1.1 does not verify that the requester owns or can edit the target…
5.9
Moyenne
CVE-2026-16276
The Classified Listing WordPress plugin before 5.4.4 does not perform a capability check on an AJAX action that returns…
2.7
Faible
CVE-2026-16274
The Classified Listing WordPress plugin before 5.4.4 does not perform a capability or ownership check on an AJAX action…
2.7
Faible
CVE-2026-14183
The Classified Listing WordPress plugin before 5.3.9 does not verify that the order targeted by its payment-receipt…
4.3
Moyenne