Unauthorized Access in AI-Powered Classified Ads Plugin for WordPress
CVE-2026-7563

4.3MEDIUM

Key Information:

Vendor

WordPress
Status
Classified Listing – Ai-powered Classified Ads & Business Directory Plugin
Vendor
CVE Published:
15 May 2026

What is CVE-2026-7563?

The Classified Listing – AI-Powered Classified Ads & Business Directory Plugin for WordPress has a security flaw in all versions up to 5.3.10, which fails to adequately validate user permissions. This vulnerability allows authenticated users with subscriber-level access and beyond to gain unauthorized control. Attackers can insert arbitrary notes into orders, leading to unsolicited notifications and moderation emails sent to listing owners, thereby undermining the system's integrity and potentially compromising sensitive information.

Affected Version(s)

Classified Listing – AI-Powered Classified ads & Business Directory Plugin 0 <= 5.3.10

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/classified-lis...
https://plugins.trac.wordpress.org/browser/classified-lis...

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

momopon1415
.