A critical authorization bypass in the Classified Listing WordPress plugin allows any authenticated user to manipulate or delete media attachments on arbitrary listings.

The plugin suffers from an authorization bypass (CWE-639) because it fails to verify user ownership before executing AI image-editing AJAX actions. Consequently, any authenticated user, including those with subscriber-level permissions, can delete or attach files to listings owned by other users.

Successful exploitation poses a significant risk to the integrity of platform data and user content. By allowing unauthorized modification or deletion of media, attackers can sabotage legitimate listings, leading to reputational damage and potential loss of service for affected users. With a CVSS score of 7.1, this high-severity vulnerability warrants immediate attention to prevent malicious data destruction.

Immediate Action: Update the Classified Listing plugin to version 6.1.1 or later immediately to implement necessary authorization checks.

Proactive Monitoring: Review web server access logs for anomalous AJAX requests targeting the plugin's media-handling endpoints, particularly those originating from accounts with low-level privileges.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to restrict access to the specific AJAX endpoints responsible for AI image editing, if an immediate update is not feasible.

Public Exploit Available: Unknown.

Given the ease with which low-privileged users can disrupt site functionality and modify user content, this vulnerability represents a significant risk to operational integrity. Administrators must prioritize updating the Classified Listing plugin to version 6.1.1 to close this authorization gap. Failure to patch may result in unauthorized data manipulation that could compromise the trust and reliability of the listing platform.