CVE-2026-106646

Deferred Deferred - Pending Action

Authenticated Media Library Modification in Classified Listing WordPress Plugin

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: WPScan

Description

The Classified Listing WordPress plugin before 6.1.1 does not verify that the requester owns or can edit the target listing when a gallery request references an unattached media item, allowing any authenticated user with a subscriber-level account to modify, corrupt or delete media-library attachments owned by other users, including administrators.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-106646

EUVD

EUVD-2026-100885

Affected Vendors & Products

Vendor	Product	Version / Range
Unknown	Classified	Listing 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability affects the WordPress plugin 'Classified Listing' versions before 6.1.1. It allows any authenticated user with a subscriber-level account to modify, corrupt, or delete media-library attachments owned by other users, including administrators. The issue occurs when a gallery request references an unattached media item because the plugin fails to verify ownership or editing permissions.

Detection Guidance

Check if the Classified Listing plugin version is below 6.1.1. Inspect WordPress media library for unauthorized modifications or deletions by subscribers. Review server logs for suspicious AJAX gallery requests referencing unattached media items.

Impact Analysis

An attacker with subscriber access could delete or alter media files, including those owned by administrators. This could lead to data loss, unauthorized changes to website content, or disruption of services. The impact is higher if the site relies on media files for critical functions.

Compliance Impact

This vulnerability could lead to unauthorized modification or deletion of sensitive media files, potentially violating GDPR (data integrity) or HIPAA (protected health information integrity). Compliance may be compromised if such files are altered or lost without authorization.

Mitigation Strategies

Update the Classified Listing plugin to version 6.1.1 or later immediately. Remove or restrict subscriber-level accounts if they are not required. Monitor media library attachments for unauthorized changes.

Hi! I’m here to help you understand CVE-2026-106646. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70