Quick answers
- Is CVE-2026-42679 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-42679 being exploited in the wild.
- How severe is CVE-2026-42679?
- Medium severity, with a CVSS score of 6.5, published 1 June 2026.
- Which products and versions are affected?
- RadiusTheme Classified Listing <= 5.3.8.
- Is there a fix for CVE-2026-42679?
- A patch was published on 2026-05-17: Version 5.3.9 released to address the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-42679 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-42679?
- Check whether you run RadiusTheme Classified Listing at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A path traversal vulnerability (CWE-22) exists in the Mamunur Rashid Classified Listing plugin for WordPress up to version 5.3.8. The flaw allows an authenticated attacker with 'Subscriber' level privileges to bypass directory restrictions and download arbitrary files from the server. This is achieved by providing manipulated file paths to a vulnerable component within the plugin. Successful exploitation can lead to the disclosure of sensitive information, including wp-config.php or other system files. The issue is resolved in version 5.3.9.
Affected products
- Mamunur Rashid Classified Listing <= 5.3.8
Timeline
- 2026-04-17: other: Reported by researcher thevietronin
- 2026-05-17: advisory: Patchstack advisory published
- 2026-06-01: disclosed: CVE published to NVD
- 2026-05-17: patched: Version 5.3.9 released to address the vulnerability