CVE-2026-106646 — Classified Listing < 6.1.1 - Subscriber+ Unattached Media Deletion and Modification via Gallery AJAX Handlers

CVE-2026-106646

Classified Listing < 6.1.1 - Subscriber+ Unattached Media Deletion and Modification via Gallery AJAX Handlers PUBLISHED

Description (CNA)

The Classified Listing WordPress plugin before 6.1.1 does not verify that the requester owns or can edit the target listing when a gallery request references an unattached media item, allowing any authenticated user with a subscriber-level account to modify, corrupt or delete media-library attachments owned by other users, including administrators.

Affected (CNA)

Vendor / product	Versions
Unknown / Classified Listing	affected 0 before 6.1.1

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/84adffd9-6982-4c05-a42d-be208035d9a8/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.