WordPress Classified Listing plugin < 6.1.1 - Arbitrary Content Deletion vulnerability

Arbitrary Content Deletion vulnerability discovered by Usama Arshad in WordPress Plugin Classified Listing versions 6.1.1...

CVE-2026-16281

The Classified Listing WordPress plugin before 6.1.1 does not verify that the caller owns or can edit the target listing before its AI image-editing AJAX action deletes or attaches media, allowing any authenticated user, including a subscriber, to permanently delete attachments from, and attach...

CVE-2026-16281 Classified Listing < 6.1.1 - Subscriber+ Arbitrary Attachment Deletion and Listing Image Tampering via IDOR

The Classified Listing WordPress plugin before 6.1.1 does not verify that the caller owns or can edit the target listing before its AI image-editing AJAX action deletes or attaches media, allowing any authenticated user, including a subscriber, to permanently delete attachments from, and attach...

CVE-2026-16281

The Classified Listing WordPress plugin (versions before 6.1.1 ) contains an Insecure Direct Object Reference (IDOR) vulnerability. The root cause is a failure to verify whether a caller owns or has permission to edit a target listing during its AI image-editing AJAX action . This allows any auth...

EUVD-2026-70900

The Classified Listing WordPress plugin before 6.1.1 does not verify that the caller owns or can edit the target listing before its AI image-editing AJAX action deletes or attaches media, allowing any authenticated user, including a subscriber, to permanently delete attachments from, and attach...

CVE-2026-16281 Classified Listing < 6.1.1 - Subscriber+ Arbitrary Attachment Deletion and Listing Image Tampering via IDOR

The Classified Listing WordPress plugin before 6.1.1 does not verify that the caller owns or can edit the target listing before its AI image-editing AJAX action deletes or attaches media, allowing any authenticated user, including a subscriber, to permanently delete attachments from, and attach...

PT-2026-85406

The Classified Listing WordPress plugin before 6.1.1 does not verify that the caller owns or can edit the target listing before its AI image-editing AJAX action deletes or attaches media, allowing any authenticated user, including a subscriber, to permanently delete attachments from, and attach...

CVE-2026-84217

Missing Authorization vulnerability in Mamunur Rashid Classified Listing classified-listing allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Classified Listing: from n/a through 6.1.3...

CVE-2026-84217 WordPress Classified Listing plugin <= 6.1.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in Mamunur Rashid Classified Listing classified-listing allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Classified Listing: from n/a through 6.1.3...

CVE-2026-84217

CVE-2026-84217 is a Missing Authorization (Broken Access Control) vulnerability in the WordPress plugin Classified Listing by Mamunur Rashid, affecting versions from unknown (n/a) through 6.1.1 . The flaw allows authenticated low-privilege users to access functionality not properly constrained by...

EUVD-2026-69945

Missing Authorization vulnerability in Mamunur Rashid Classified Listing allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Classified Listing: from n/a through 6.1.1...

CVE-2026-84217 WordPress Classified Listing plugin <= 6.1.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in Mamunur Rashid Classified Listing classified-listing allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Classified Listing: from n/a through 6.1.3...

WordPress Classified Listing plugin <= 6.1.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Muhammad Bilal bilalmajid1 in WordPress Plugin Classified Listing versions = 6.1.2...

PT-2026-84696

Name of the Vulnerable Software and Affected Versions Mamunur Rashid Classified Listing versions prior to 6.1.1 Description A missing authorization issue allows access to functionality that is not properly constrained by Access Control Lists ACLs, which are sets of rules that define which users o...

EUVD-2026-66410

The Classified Listing - Mobile Number Verification plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.6.0. This is due to missing server-side Firebase OTP validation in the processotplogin function. This makes it possible for unauthenticated...

CVE-2026-15985 Classified Listing - Mobile Number Verification <= 1.6.0 - Unauthenticated Authentication Bypass via Firebase OTP Login

The Classified Listing - Mobile Number Verification plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.6.0. This is due to missing server-side Firebase OTP validation in the processotplogin function. This makes it possible for unauthenticated...

CVE-2026-15985 Classified Listing - Mobile Number Verification <= 1.6.0 - Unauthenticated Authentication Bypass via Firebase OTP Login

The Classified Listing - Mobile Number Verification plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.6.0. This is due to missing server-side Firebase OTP validation in the processotplogin function. This makes it possible for unauthenticated...

CVE-2026-15985

The Classified Listing – Mobile Number Verification WordPress plugin is vulnerable to unauthenticated authentication bypass in all versions up to and including 1.6.0 . The root cause is missing server-side Firebase OTP validation in the process_otp_login() function, allowing an attacker to authen...

WordPress Classified Listing - Mobile Number Verification plugin <= 1.6.0 - Unauthenticated Authentication Bypass via Firebase OTP Login vulnerability

WordPress Classified Listing - Mobile Number Verification plugin = 1.6.0 - Unauthenticated Authentication Bypass via Firebase OTP Login vulnerability discovered by Rafie Muhammad - Awesome Motive, Inc. in WordPress Plugin Classified Listing - Mobile Number Verification versions = 1.6.0...

PT-2026-82087

The Classified Listing - Mobile Number Verification plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.6.0. This is due to missing server-side Firebase OTP validation in the process otp login function. This makes it possible for unauthenticated...