Description

Missing Authorization vulnerability in Mamunur Rashid Classified Listing allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Classified Listing: from n/a through 6.1.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-09-02T12:17:13.900Z",
  "pubdate": "2026-09-02T12:17:13.900Z",
  "executiveSummary": "The Classified Listing plugin for WordPress is susceptible to a Missing Authorization vulnerability, classified under improper access control. This security flaw allows unauthenticated or unauthorized users to interact with sensitive plugin functionalities that lack proper Access Control List (ACL) constraints.\nThe vulnerability resides in Classified Listing versions from n/a through 6.1.1. By failing to validate the authorization level of the user before executing specific administrative or privileged functions, the plugin enables attackers to perform unauthorized operations.\nThe risk implications are significant, as an attacker can manipulate, delete, or access data intended only for authorized users, potentially leading to unauthorized information disclosure, data integrity loss, or administrative feature abuse.\nExploitation requires no complex authentication or high-privilege credentials, as the underlying functions lack the necessary capability checks to restrict access. This exposes the application to unauthorized requests that bypass the intended security model. System administrators are advised to restrict access to plugin features or update to a patched version once available to mitigate the risk of unauthorized function invocation.",
  "technicalDetails": "The root cause of this vulnerability is the absence of rigorous authorization checks (such as nonce verification and capability checks using current_user_can()) within the administrative or functional handlers of the Classified Listing plugin. When a request is made to specific endpoints or functions, the application fails to verify if the requester possesses the required permissions (e.g., 'manage_options' or 'edit_posts') before proceeding with the execution of the requested logic.\nThe exploitation method leverages the lack of server-side validation for user-initiated actions. Attackers can identify endpoints within the plugin that perform critical tasks and craft unauthorized HTTP GET or POST requests directed at these endpoints. Since the plugin's internal logic assumes that all incoming requests are legitimate and authorized, it processes these requests without verifying the session's privilege level.\nThe attack flow follows a predictable sequence: First, the attacker identifies a sensitive function or endpoint within the Classified Listing plugin that performs a state-changing operation or retrieves restricted data. Second, the attacker interacts with the target function directly by invoking the appropriate hook or URL, potentially manipulating input parameters to suit the desired outcome. Third, the plugin's backend fails to perform a capability check, executing the logic as if initiated by an administrator or a user with elevated privileges. Finally, the attacker achieves the intended unauthorized action, such as modifying system configurations, accessing private user data, or performing privileged administrative tasks.\nThe vulnerable component involves the underlying code structure handling user requests, which failed to implement necessary checks across the affected version range (n/a through 6.1.1). The exposure is network-based, as any remote user capable of interacting with the plugin's frontend or backend interface can potentially trigger these functions.\nThe post-exploitation impact includes the total compromise of plugin-specific functionality. If the missing authorization applies to data-fetching functions, an attacker can perform mass data exfiltration of classified listings. If the missing authorization applies to management functions, an attacker could delete listings, modify settings, or perform actions that could lead to further persistence or impact on the overall WordPress installation integrity. The lack of proper ACL enforcement means the system cannot distinguish between an authorized administrator and an anonymous malicious actor."
}