Unauthorized Data Modification in Classified Listing Plugin for WordPress

CVE-2025-12953

What is CVE-2025-12953?

The Classified Listing – AI-Powered Classified ads & Business Directory Plugin for WordPress contains a vulnerability that permits authenticated attackers, with a subscriber role or higher, to make unauthorized changes to listing types. The flaw arises from a lack of capability checks in critical AJAX functions, specifically 'rtcl_ajax_add_listing_type', 'rtcl_ajax_update_listing_type', and 'rtcl_ajax_delete_listing_type'. This oversight allows these attackers to add, update, or delete listing types, potentially leading to significant data integrity issues on affected websites.

References