Subscriber Broken Access Control in Classified Listing Plugin

Executive Summary

The WordPress Classified Listing Plugin versions 5.4.2 and below contain a Broken Access Control vulnerability (CVE-2026-57355). This means that unprivileged users, such as subscribers, can perform actions that normally require higher privileges because the plugin lacks proper authorization, authentication, or nonce token checks.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers with low privileges to perform higher-privileged actions, potentially compromising the integrity of your website. It can be exploited in mass campaigns targeting thousands of websites, increasing the risk of unauthorized changes or misuse of your Classified Listing plugin.

Useful 0 Not Useful 0

Detection Guidance

The vulnerability allows unprivileged users (e.g., subscribers) to perform higher-privileged actions due to missing authorization, authentication, or nonce token checks in the WordPress Classified Listing Plugin versions 5.4.2 and below.

Detection would involve checking if your system is running the vulnerable plugin version (5.4.2 or below) and monitoring for unauthorized actions performed by subscriber-level users.

Specific commands to detect exploitation attempts are not provided in the available resources.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate recommended action is to update the WordPress Classified Listing Plugin to version 5.4.3 or later, where the vulnerability has been patched.

If you are a Patchstack user, enabling auto-updates for vulnerable plugins can help ensure timely patching.

Useful 0 Not Useful 0