Executive brief
The Classified Listing plugin for WordPress, which allows users to create and manage business directories, contains a security flaw in how it handles image updates. An attacker with a basic user account can change the featured image of any listing on the site, even those they do not own. This could be used to deface business listings or disrupt the professional appearance of the directory.
Technical details
The vulnerability exists in the 'gallery_image_update_as_feature' AJAX handler (action: rtcl_fb_gallery_image_update_as_feature) due to a lack of capability or ownership checks. While the handler validates a security nonce, this nonce is exposed to any logged-in user via the frontend listing-submission form. An authenticated attacker can provide a listing ID and an attachment ID to update the featured image of any listing. This is classified as a Missing Authorization (CWE-862) issue. The vulnerability is present in all versions up to 5.4.2.
Affected products
- RadiusTheme (techlabpro1) Classified Listing – Classified ads & Business Directory up to, and including, 5.4.2
Timeline
- 2026-06-19: disclosed
- 2026-06-19: advisory
References
- https://plugins.trac.wordpress.org/browser/classified-listing/tags/5.3.8/app/Controllers/Ajax/FormBuilderAjax.php
- https://plugins.trac.wordpress.org/browser/classified-listing/tags/5.3.8/app/Controllers/Ajax/FormBuilderAjax.php
- https://plugins.trac.wordpress.org/browser/classified-listing/tags/5.3.8/app/Controllers/Ajax/FormBuilderAjax.php
- https://plugins.trac.wordpress.org/browser/classified-listing/tags/5.4.2/app/Controllers/Ajax/FormBuilderAjax.php
- https://plugins.trac.wordpress.org/browser/classified-listing/tags/5.4.2/app/Controllers/Ajax/FormBuilderAjax.php
- https://plugins.trac.wordpress.org/browser/classified-listing/tags/5.4.2/app/Controllers/Ajax/FormBuilderAjax.php
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3571741%40classified-listing&new=3571741%40classified-listing&sfp_email=&sfph_mail=