CVE-2026-16281: Classified Listing < 6.1.1 - Subscriber+ Arbitrary Attachment Deletion and Listing Image Tampering via IDOR
The Classified Listing WordPress plugin before 6.1.1 does not verify that the caller owns or can edit the target listing before its AI image-editing AJAX action deletes or attaches media, allowing any authenticated user, including a subscriber, to permanently delete attachments from, and attach files to, any listing owned by another user.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated WordPress user can exploit it, including users with only the Subscriber role. The vulnerable plugin does not verify that the user owns or is allowed to edit the targeted listing.
What can an attacker do through the vulnerable action?
An attacker can use the plugin's AI image-editing AJAX action to permanently delete attachments associated with another user's listing or attach files to that listing. This can alter listing images and remove media belonging to other users.
Which plugin versions are affected?
Classified Listing versions before 6.1.1 are affected. Upgrading to version 6.1.1 or later addresses the reported issue.