Is CVE-2026-84217 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-84217 being exploited in the wild.

How severe is CVE-2026-84217?

Medium severity, with a CVSS score of 5.4, published 2 September 2026.

Which products and versions are affected?

Mamunur Rashid Classified Listing through 6.1.3.

Is there a fix for CVE-2026-84217?

A patch was published on 2026-09-02: Patched in version 6.1.5 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-84217 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-84217?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-84217: Mamunur Rashid Classified Listing broken access control

CVE-2026-84217 · Severity: medium · CVSS 5.4 · Published 2026-09-02

Classified Listing is a WordPress plugin for creating and managing classified ad listings. A broken access control vulnerability allows subscribers to access pages and perform actions they are not authorized for, such as viewing other users' data or private listings. An attacker with a basic subscriber account can escalate their privileges to view or modify sensitive information, compromising site data integrity and user privacy.

Quick answers

Is CVE-2026-84217 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-84217 being exploited in the wild.
How severe is CVE-2026-84217?: Medium severity, with a CVSS score of 5.4, published 2 September 2026.
Which products and versions are affected?: Mamunur Rashid Classified Listing through 6.1.3.
Is there a fix for CVE-2026-84217?: A patch was published on 2026-09-02: Patched in version 6.1.5 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-84217 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-84217?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is classified as broken access control (CWE-276/639), affecting Classified Listing versions through 6.1.3. A subscriber-level user can bypass access control lists (ACLs) to access functionality and pages that should be restricted to higher-privilege accounts. The attack requires authentication as a subscriber but no additional preconditions. An attacker can view other users' private data, listings, or perform administrative actions. The issue is patched in version 6.1.5.

Affected products

Mamunur Rashid Classified Listing through 6.1.3

Timeline

2026-07-22: disclosed: Reported to Patchstack
2026-09-02: advisory: Published by Patchstack and NVD
2026-09-02: patched: Patched in version 6.1.5

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.