# CVE-2026-42679: Mamunur Rashid Classified Listing path traversal in arbitrary file download

Source: https://junglewise.ai/threats/cve-2026-42679-mamunur-rashid-classified-listing-path-traversal-in-arbitrary  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-01. Updated: 2026-06-01  
License: CC BY 4.0 with a link back

CVE-2026-42679 · Severity: medium · CVSS 6.5 · Published 2026-06-01

The Classified Listing plugin for WordPress, which allows users to create and manage classified ads, contains a security flaw that could allow unauthorized file access. An attacker with a basic user account can exploit this to download sensitive files from the web server, such as configuration files containing database credentials or site backups. This could lead to a full compromise of the website and its data.

Technologies: [RadiusTheme Classified Listing](https://junglewise.ai/threats/technologies/classified-listing). Vendors: [RadiusTheme](https://junglewise.ai/threats/vendors/radiustheme).

## Quick answers

**Is CVE-2026-42679 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-42679 being exploited in the wild.

**How severe is CVE-2026-42679?** Medium severity, with a CVSS score of 6.5, published 1 June 2026.

**Which products and versions are affected?** RadiusTheme Classified Listing <= 5.3.8.

**Is there a fix for CVE-2026-42679?** A patch was published on 2026-05-17: Version 5.3.9 released to address the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-42679 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-42679?** Check whether you run RadiusTheme Classified Listing at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A path traversal vulnerability (CWE-22) exists in the Mamunur Rashid Classified Listing plugin for WordPress up to version 5.3.8. The flaw allows an authenticated attacker with 'Subscriber' level privileges to bypass directory restrictions and download arbitrary files from the server. This is achieved by providing manipulated file paths to a vulnerable component within the plugin. Successful exploitation can lead to the disclosure of sensitive information, including wp-config.php or other system files. The issue is resolved in version 5.3.9.

## Affected products

- Mamunur Rashid Classified Listing <= 5.3.8

## Timeline

- 2026-04-17: other: Reported by researcher thevietronin
- 2026-05-17: advisory: Patchstack advisory published
- 2026-06-01: disclosed: CVE published to NVD
- 2026-05-17: patched: Version 5.3.9 released to address the vulnerability

## References

- [https://patchstack.com/database/wordpress/plugin/classified-listing/vulnerability/wordpress-classified-listing-plugin-5-3-8-arbitrary-file-download-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/classified-listing/vulnerability/wordpress-classified-listing-plugin-5-3-8-arbitrary-file-download-vulnerability?_s_id=cve)

## Related threats

- [RadiusTheme Classified Listing IDOR in payment-receipt handler](https://junglewise.ai/threats/cve-2026-14183-radiustheme-classified-listing-idor-in-payment-receipt-handler)
- [RadiusTheme Classified Listing broken access control](https://junglewise.ai/threats/cve-2026-57355-radiustheme-classified-listing-broken-access-control)
- [RadiusTheme Classified Listing unauthenticated XSS](https://junglewise.ai/threats/cve-2026-57344-radiustheme-classified-listing-unauthenticated-xss)
- [RadiusTheme Classified Listing missing authorization in AJAX handler](https://junglewise.ai/threats/cve-2026-10779-radiustheme-classified-listing-missing-authorization-in-ajax)
- [Mamunur Rashid Classified Listing unauthenticated XSS](https://junglewise.ai/threats/cve-2026-42658-mamunur-rashid-classified-listing-unauthenticated-xss)