CVE-2026-42679
Path Traversal in Classified Listing Plugin
Publication date: 2026-06-01
Last updated on: 2026-06-01
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| patchstack | classified_listing | From 5.3.0 (inc) to 5.3.8 (inc) |
| mamunur_rashid | classified_listing | From 5.3.0 (inc) to 5.3.8 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-42679 is a Path Traversal vulnerability in the WordPress Classified Listing Plugin (versions 5.3.8 and below). This vulnerability allows an attacker to perform arbitrary file downloads from the affected website.
Specifically, the attacker can exploit improper limitation of a pathname to a restricted directory, enabling them to access sensitive files such as login credentials or backups that should not be publicly accessible.
The vulnerability is classified under OWASP Top 10's "Broken Access Control" and has a CVSS v3.1 base score of 6.5, indicating a medium to high severity.
How can this vulnerability impact me? :
This vulnerability can have serious impacts as it allows attackers to download arbitrary files from your website.
- Attackers could obtain sensitive information such as login credentials.
- Backups and other confidential files could be exposed.
- Such unauthorized access could lead to further compromise of your website or data.
Because of its severity and potential for mass exploitation, it is highly recommended to update the plugin to version 5.3.9 or later immediately.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability allows arbitrary file downloads via path traversal in the WordPress Classified Listing Plugin versions 5.3.8 and below.
To detect exploitation attempts on your system or network, you can monitor web server logs for suspicious requests containing path traversal patterns such as "../" or encoded variants attempting to access sensitive files.
- Use command-line tools like grep to search for suspicious URL patterns in access logs, for example: grep -E "(\.\./|%2e%2e/)" /var/log/apache2/access.log
- Monitor for requests targeting files that should not be publicly accessible, such as configuration files or backups.
Additionally, applying the mitigation rule provided by Patchstack can help block attack attempts until the plugin is updated.
What immediate steps should I take to mitigate this vulnerability?
The immediate step to mitigate this vulnerability is to update the WordPress Classified Listing Plugin to version 5.3.9 or later, where the issue is patched.
Until the update can be applied, users are advised to implement the mitigation rule issued by Patchstack to block attacks exploiting this vulnerability.
Regularly monitor your system for suspicious activity and ensure backups are secure.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows attackers to download arbitrary files, including potentially sensitive information such as login credentials or backups. This exposure of sensitive data can lead to non-compliance with data protection regulations like GDPR and HIPAA, which require safeguarding personal and sensitive information against unauthorized access.
Because the vulnerability is classified under OWASP Top 10's "Broken Access Control," it indicates a failure to properly restrict access to sensitive resources, which is a critical requirement in many compliance frameworks.
Organizations using affected versions of the Classified Listing plugin should update immediately to mitigate risks of data breaches that could result in regulatory penalties.