Improper Access Control in Classified Listing Plugin for WordPress
CVE-2026-106646

Currently unrated

Key Information:

Vendor

WordPress
Status
Classified Listing
Vendor
CVE Published:
14 October 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-106646?

The Classified Listing Plugin for WordPress prior to version 6.1.1 contains a vulnerability that allows authenticated users with subscriber-level accounts to manipulate, corrupt, or delete media-library attachments owned by other users. This occurs due to the plugin's failure to validate whether the requester has permission to edit the target listing, particularly when dealing with unattached media items. As a result, this weakness presents a significant risk, requiring administrators to enforce strict access controls and promptly update to the latest version.

Affected Version(s)

Classified Listing 0 < 6.1.1

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-106646 - Proof of Concept

References

https://wpscan.com/vulnerability/84adffd9-6982-4c05-a42d-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Naoki Kawahigashi
WPScan
.