CVE-2026-84217: WordPress Classified Listing plugin <= 6.1.3 - Broken Access Control vulnerability

Q: What level of access does an attacker need to exploit this issue?

An attacker needs an existing account with low privileges. No user interaction is required, and the issue can be exploited over the network.

Q: What is the potential impact if exploitation succeeds?

The vulnerability can allow unauthorized access to functionality that is not properly constrained by access controls. Its listed impact is limited to integrity and availability; no confidentiality impact is identified.

Q: Which plugin versions are affected?

Classified Listing versions through 6.1.1 are affected. The earliest affected version is not specified.

Published Sep 2, 2026

Updated

Missing Authorization vulnerability in Mamunur Rashid Classified Listing classified-listing allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Classified Listing: from n/a through 6.1.3.

Affected Software

1 affected component

Mamunur Rashid Classified Listing<=6.1.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress Classified Listing to a version that resolves this vulnerability.
Fixed in 6.1.5

Event History

Sep 2, 2026

CVE Published

via MITRE·11:56 AM

Data Sourced

via MITRE·11:56 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·12:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

An attacker needs an existing account with low privileges. No user interaction is required, and the issue can be exploited over the network.

What is the potential impact if exploitation succeeds?