CVE-2026-106646: Classified Listing 0 to before 6.1.1

Affected technology

Classified Listing · 0 to before 6.1.1
Vendor not specified by the source

Description’s affected range: before 6.1.1 does not verify that the requester owns or can edit the target listing when a gallery request references an unattached media item

Component: Not specified by the source

Attack conditions (Source advisory, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

The source says the Classified Listing WordPress plugin before 6.1.1 does not verify that the requester owns or can edit the target listing when a gallery request references an unattached media item, allowing any authenticated user with a subscriber-level account to modify, corrupt or delete media-library attachments owned by other users, including administrators. Source advisory’s CVSS 3.1 assessment (base score 5.9/10) rates confidentiality impact as none; integrity impact as high; availability impact as low.