Detections
Analytics
CVE-2026-16281
high
Description
The Classified Listing WordPress plugin before 6.1.1 does not verify that the caller owns or can edit the target listing before its AI image-editing AJAX action deletes or attaches media, allowing any authenticated user, including a subscriber, to permanently delete attachments from, and attach files to, any listing owned by another user.
References
https://wpscan.com/vulnerability/e6a781c3-570f-4293-8f4c-9331389dd100/