CVE-2026-16281
Received Received - Intake

Authenticated User Access Control Bypass in Classified Listing Plugin

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: WPScan

Description
The Classified Listing WordPress plugin before 6.1.1 does not verify that the caller owns or can edit the target listing before its AI image-editing AJAX action deletes or attaches media, allowing any authenticated user, including a subscriber, to permanently delete attachments from, and attach files to, any listing owned by another user.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-16281
EUVD
EUVD-2026-70900

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
classified_listing wordpress_plugin to 6.1.1 (exc)
classified_listing classified_listing to 6.1.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Insecure Direct Object Reference (IDOR) flaw in the Classified Listing WordPress plugin before version 6.1.1. It allows any authenticated user, including low-privilege subscribers, to delete attachments from or attach files to listings owned by other users without proper ownership verification. The issue occurs in an AI image-editing AJAX action that fails to check permissions.

Detection Guidance

Check if your WordPress site uses the Classified Listing plugin version prior to 6.1.1. Log in as a subscriber or low-privilege user and attempt to delete or attach files to listings owned by other users via the AI image-editing AJAX action.

Impact Analysis

An attacker could exploit this to permanently delete important files attached to listings, such as images or documents, causing data loss. They could also attach malicious files to listings, potentially spreading malware or violating content policies. This affects the integrity and availability of listings and their associated media.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA by enabling unauthorized modification or deletion of sensitive data. GDPR requires protecting personal data integrity, while HIPAA mandates safeguarding protected health information. Exploits could result in unauthorized access or data breaches, triggering regulatory penalties.

Mitigation Strategies

Update the Classified Listing plugin to version 6.1.1 or later immediately. If updating is not possible, consider disabling the plugin temporarily until an update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-16281. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart