CVE-2026-16281

HighCVSS 7.1

Published: 04/09/2026(UTC)Updated: 08/09/2026(UTC)Translated: 04/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.20%

9th percentile - higher than 9% of all known CVEs

Summary

The Classified Listing WordPress plugin before version 6.1.1 does not verify that the caller owns or can edit the target listing before its AI image-editing AJAX action deletes or attaches media. This allows any authenticated user, including a subscriber, to permanently delete attachments from, and attach files to, any listing owned by another user.

Risk Assessment

The organization may suffer reputational and operational damage because low-privileged authenticated users can destroy other users' data, leading to loss of content integrity and trust in the platform.

Recommendation

It is recommended to immediately update the Classified Listing plugin to version 6.1.1 or later, which includes the security fix.

Other vulnerabilities in Classified Listing WordPress plugin

CVE-2026-106646Medium
The Classified Listing WordPress plugin before 6.1.1 does not verify that the requester owns or can edit the target listing when a gallery request references an unattached media item. This allows any authenticated user with a subscriber-level account to modify, corrupt or delete media-library attachments owned by other users, including administrators.

Original NVD description (English source)

The Classified Listing WordPress plugin before 6.1.1 does not verify that the caller owns or can edit the target listing before its AI image-editing AJAX action deletes or attaches media, allowing any authenticated user, including a subscriber, to permanently delete attachments from, and attach files to, any listing owned by another user.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS