high7.1
CVE-2026-16281
The Classified Listing WordPress plugin before 6.1.1 does not verify that the caller owns or can edit the target listing before its AI image-editing AJAX actio…
Impact
The Classified Listing WordPress plugin before 6.1.1 does not verify that the caller owns or can edit the target listing before its AI image-editing AJAX action deletes or attaches media, allowing any authenticated user, including a subscriber, to permanently delete attachments from, and attach files to, any listing owned by another user.
Affected products
| Product | Affected versions |
|---|---|
| Classified Listing WordPress Plugin | before 6.1.1 |
Versions were read from the advisory text. No structured product data has been published for this record yet.