CVE-2026-106646 in Classified Listing Plugin
Summary
by MITRE • 10/14/2026
The Classified Listing WordPress plugin before 6.1.1 does not verify that the requester owns or can edit the target listing when a gallery request references an unattached media item, allowing any authenticated user with a subscriber-level account to modify, corrupt or delete media-library attachments owned by other users, including administrators.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/14/2026
The vulnerability identified in Classified Listing WordPress plugin versions prior to 6.1.1 represents a critical failure in access control logic within the application's media handling subsystem. Specifically, when processing gallery requests that reference unattached media items, the software fails to perform adequate authorization checks to verify whether the requesting user possesses ownership or editing privileges over the target listing associated with those media files. This oversight creates an insecure direct object reference scenario where the system relies on client-supplied identifiers without validating the relationship between the authenticated session and the resource being accessed. Consequently, any authenticated user holding even a minimal subscriber-level account can manipulate gallery data belonging to other users, including high-privilege administrators.
From a technical perspective, this flaw stems from insufficient server-side validation of object ownership during file management operations. When a user submits a request to modify or delete media attachments linked to a listing, the application accepts these actions without confirming that the current session's user ID matches the owner ID of the target resource. This lack of integrity verification allows attackers to craft malicious requests targeting arbitrary media IDs in the database. Since unattached media items are often stored with predictable identifiers or accessible via known paths, an attacker can enumerate and select specific targets to execute unauthorized operations against them.
The operational impact of this vulnerability is severe due to its potential for data corruption, loss, and privilege escalation through social engineering or account compromise. An authenticated subscriber-level user can delete critical media assets belonging to administrators or other high-privilege users, leading to significant disruption in business operations if those images are essential for classified listings. Furthermore, the ability to corrupt gallery structures may render entire listing pages unusable, causing denial of service conditions for legitimate users. In environments where trust levels are loosely enforced among subscribers, this flaw undermines the fundamental security model by allowing low-privilege accounts to exert destructive control over high-value assets managed by privileged roles.
This vulnerability aligns with CWE-284 Improper Access Control and CWE-601 URL Redirection to Untrusted Site or in some contexts reflects aspects of CWE-915 if the modification leads to unintended state changes that affect system integrity. In terms of MITRE ATT&CK, this behavior corresponds to T1078 Valid Accounts, as it requires initial authentication but exploits weak authorization checks post-login, and potentially T1485 Data Destruction or T1222 File and Directory Permissions Modification depending on the specific outcome of the malicious requests. The attack vector is classified as remote with low complexity since it only requires valid credentials which are often easier to obtain than unauthenticated access vectors in public-facing WordPress sites.
Mitigation strategies must prioritize immediate patching to version 6.1.1 or later where these authorization checks have been implemented correctly. Administrators should ensure that all media handling endpoints enforce strict ownership verification, ensuring that the user initiating a delete or modify operation is explicitly listed as an owner or editor of the associated listing object before processing the request. Additionally, implementing server-side validation for unattached media items to restrict access based on explicit permission grants rather than implicit assumptions can prevent exploitation. Regular security audits focusing on role-based access control mechanisms across all plugin functionalities are recommended to identify similar logic flaws in other modules that handle user-generated content or file management operations.