Executive brief
The Classified Listing WordPress plugin is used by site administrators to manage classified listings and marketplace content. A vulnerability in its AI image-editing feature allows any logged-in user, even with minimal permissions, to delete attachments from and modify images on listings owned by other users without authorization. This could lead to disruption of legitimate listings and unauthorized modification of marketplace content.
Technical details
The plugin's AI image-editing AJAX action fails to verify that the authenticated user owns or has permission to edit the target listing before processing media operations (deletion and attachment). This is an Insecure Direct Object Reference (IDOR) vulnerability exploitable by any authenticated user, including subscribers with minimal permissions. An attacker can directly reference another user's listing ID in AJAX requests to permanently delete attachments or attach malicious files. No special authentication or user interaction is required beyond basic login access. The vulnerability was patched in version 6.1.1.
Affected products
- WordPress Classified Listing before 6.1.1
Timeline
- 2026-09-04: disclosed: Public disclosure via NVD
- 2026-09-04: patched: Fixed in version 6.1.1