CVE-2026-106646: Classified Listing < 6.1.1 - Subscriber+ Unattached Media Deletion and Modification via Gallery AJAX Handlers

Q: Which users could exploit this issue?

Any authenticated user with a subscriber-level account can exploit it. The attacker does not need to own the target media attachment or have permission to edit the associated listing.

Q: What media is at risk?

The issue affects unattached media-library attachments referenced by a gallery request. Such attachments can be modified, corrupted, or deleted even when they are owned by another user, including an administrator.

Q: Which plugin versions are affected?

Classified Listing versions before 6.1.1 are affected. Version 6.1.1 is the first version identified as not affected by the described issue.

Published Oct 14, 2026

Updated

The Classified Listing WordPress plugin before 6.1.1 does not verify that the requester owns or can edit the target listing when a gallery request references an unattached media item, allowing any authenticated user with a subscriber-level account to modify, corrupt or delete media-library attachments owned by other users, including administrators.

Affected Software

1 affected component

Classified Listing<6.1.1

Event History

Oct 14, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Which users could exploit this issue?

Any authenticated user with a subscriber-level account can exploit it. The attacker does not need to own the target media attachment or have permission to edit the associated listing.

What media is at risk?

The issue affects unattached media-library attachments referenced by a gallery request. Such attachments can be modified, corrupted, or deleted even when they are owned by another user, including an administrator.

Which plugin versions are affected?

Classified Listing versions before 6.1.1 are affected. Version 6.1.1 is the first version identified as not affected by the described issue.