CVE-2026-106646

MediumCVSS 5.9

Published: 14/10/2026(UTC)Updated: 14/10/2026(UTC)Translated: 14/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.17%

6th percentile - higher than 6% of all known CVEs

Summary

The Classified Listing WordPress plugin before 6.1.1 does not verify that the requester owns or can edit the target listing when a gallery request references an unattached media item. This allows any authenticated user with a subscriber-level account to modify, corrupt or delete media-library attachments owned by other users, including administrators.

Risk Assessment

Unauthorized modification or deletion of media files can lead to data loss and site disruption. The risk is particularly relevant in multi-user sites.

Recommendation

Update the Classified Listing plugin to version 6.1.1 or later. Consider restricting subscriber permissions to the media library.

Other vulnerabilities in Classified Listing WordPress plugin

CVE-2026-16281High
The Classified Listing WordPress plugin before version 6.1.1 does not verify that the caller owns or can edit the target listing before its AI image-editing AJAX action deletes or attaches media. This allows any authenticated user, including a subscriber, to permanently delete attachments from, and attach files to, any listing owned by another user.

Original NVD description (English source)

The Classified Listing WordPress plugin before 6.1.1 does not verify that the requester owns or can edit the target listing when a gallery request references an unattached media item, allowing any authenticated user with a subscriber-level account to modify, corrupt or delete media-library attachments owned by other users, including administrators.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS