CVE-2024-11194 in Classified Listing Plugin
Summary
by MITRE • 11/19/2024
The Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a misconfigured check on the 'rtcl_import_settings' function in all versions up to, and including, 3.1.15.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update limited arbitrary options on the WordPress site. This can be leveraged to update the Subscriber role with Administrator-level capabilities to gain administrative user access to a vulnerable site. The vulnerability is limited in that the option updated must have a value that is an array.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/25/2026
The Classified Listing plugin for WordPress presents a critical privilege escalation vulnerability through improper access control mechanisms within its rtcl_import_settings function. This flaw affects all versions up to and including 3.1.15.1, creating a pathway for authenticated attackers who possess Subscriber-level privileges or higher to manipulate core WordPress configuration options. The vulnerability stems from insufficient validation of user capabilities during the settings import process, allowing malicious actors to exploit the system's trust in legitimate administrative functions.
Technical exploitation of this vulnerability relies on the plugin's failure to properly verify user permissions when processing the rtcl_import_settings function. Attackers with Subscriber-level access can leverage this weakness to modify specific WordPress options that accept array values, creating a vector for privilege elevation. The misconfigured access control check does not adequately distinguish between different user roles during the import operation, enabling lower-privileged users to execute administrative functions that should be restricted to users with higher permissions. This represents a direct violation of the principle of least privilege and demonstrates poor implementation of role-based access controls.
The operational impact of this vulnerability extends beyond simple data modification, as it provides attackers with the capability to escalate their privileges within the WordPress environment. By manipulating specific array-based options, authenticated users can potentially modify core system configurations that affect user roles and capabilities. This particular weakness allows for the modification of the Subscriber role itself, enabling attackers to grant themselves administrative privileges through carefully crafted settings updates. The limited scope requiring array values does not mitigate the severity of the vulnerability, as it still enables complete administrative compromise of affected sites.
Security practitioners should implement immediate mitigations including plugin version updates to address the identified access control flaw, along with comprehensive monitoring of user activities related to settings modifications. The vulnerability aligns with CWE-284 Access Control Issues and represents a clear violation of the ATT&CK technique T1078 Valid Accounts, as it allows attackers to leverage legitimate user credentials for unauthorized privilege escalation. Organizations should also consider implementing additional controls such as role-based access restrictions on administrative functions and regular security audits of plugin configurations to prevent exploitation of similar vulnerabilities in other WordPress components.
This vulnerability underscores the importance of proper input validation and access control implementation within WordPress plugins, particularly those handling administrative functions. The flaw demonstrates how seemingly minor configuration issues can lead to significant security implications when combined with legitimate user capabilities. Security teams must prioritize patch management processes for third-party plugins while maintaining vigilance against similar privilege escalation vectors that may exist in other components of the WordPress ecosystem.