Executive brief
The Classified Listing plugin for WordPress, which is used to create and manage classified advertisement websites, contains a security flaw in its access control mechanisms. This vulnerability allows users with basic 'Subscriber' accounts to perform actions that should be restricted to higher-level administrators. An attacker could exploit this to modify site data or settings, potentially disrupting the service or altering advertisement listings.
Technical details
The Classified Listing plugin for WordPress (versions 5.4.2 and below) suffers from a broken access control vulnerability due to missing authorization checks (CWE-862). An attacker authenticated with low-level 'Subscriber' privileges can exploit this flaw via network requests to execute functions or modify data that should be restricted to administrative roles. The vulnerability specifically impacts integrity, as indicated by the CVSS vector (I:H). The issue is resolved in version 5.4.3, which introduces proper authorization validation.
Affected products
- RadiusTheme Classified Listing <= 5.4.2
Timeline
- 2026-05-19: other: Reported by researcher Septio Noerdiansyah
- 2026-07-01: advisory: Patchstack advisory published
- 2026-07-02: disclosed: NVD publication date
- 2026-07-01: patched: Version 5.4.3 released to address the issue