Description

The Classified Listing WordPress plugin before 6.1.1 does not verify that the caller owns or can edit the target listing before its AI image-editing AJAX action deletes or attaches media, allowing any authenticated user, including a subscriber, to permanently delete attachments from, and attach files to, any listing owned by another user.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-09-04T07:17:08.730Z",
  "pubdate": "2026-09-04T07:17:08.730Z",
  "executiveSummary": "The Classified Listing WordPress plugin, in versions prior to 6.1.1, contains a critical broken access control vulnerability within its AI-powered image editing functionality. This flaw arises from a failure to perform authorization checks during AJAX-based media processing operations. By manipulating requests, any authenticated user—including those with minimal privileges such as subscribers—can exert unauthorized control over media assets associated with arbitrary listings. The impact is significant, as it allows attackers to permanently delete legitimate media attachments or force-attach malicious files to listings owned by other users. This vulnerability compromises the integrity and availability of site content and potentially exposes users to further social engineering or malicious content injection. The vulnerability is exploitable remotely and requires only an authenticated session on the WordPress platform.",
  "technicalDetails": "The vulnerability resides within the AI image-editing AJAX handler implemented in the Classified Listing plugin. The root cause is a deficiency in the authorization logic: the plugin fails to validate whether the current user possesses the necessary ownership or editing permissions for the target listing ID passed during an AJAX request.\nDuring the execution of the affected AJAX action, the code processes media-related modifications—specifically file deletion and attachment updates—based solely on input parameters provided by the caller. Because the server-side logic lacks an ownership verification step (e.g., checking if the current user ID matches the post author ID), the system treats all authenticated requests as authorized.\nAn attack flow commences when an authenticated user intercepts an AJAX request intended for image processing within the Classified Listing interface. The attacker modifies the listing identifier (post ID) and the media reference (attachment ID) parameters within the payload. Upon submitting this crafted request, the backend server processes the deletion or attachment modification command for the specified target, regardless of the attacker's actual permissions. This allows the attacker to systematically prune media files from any classified listing on the site or inject arbitrary file associations.\nThis vulnerability is classified as an Insecure Direct Object Reference (IDOR) that leads to unauthorized write and delete operations. Because the AJAX handler does not perform capability checks (such as using current_user_can on the specific post object), the integrity of the database is effectively exposed to any logged-in user. The attack is restricted to authenticated users, but since many WordPress installations allow open registration, the barrier to entry is extremely low. Post-exploitation, the impact includes unauthorized content modification, potential site defacement, and the manipulation of listing assets to mislead users or disrupt platform services."
}