CVE-2026-16281

7.1 Élevée

Publiée le 04/09/2026 à 09:17 · Modifiée le 08/09/2026 à 21:15 · Analyse NVD reportée · Source : contact@wpscan.com

Description

The Classified Listing WordPress plugin before 6.1.1 does not verify that the caller owns or can edit the target listing before its AI image-editing AJAX action deletes or attaches media, allowing any authenticated user, including a subscriber, to permanently delete attachments from, and attach files to, any listing owned by another user.

Traduire en français

Produits concernés

Unknown Classified Listing

Scores CVSS

Version	Score	Source	Vecteur
3.1	7.1 Élevée	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L`

Faiblesses (CWE)

CWE-639

Références

https://wpscan.com/vulnerability/e6a781c3-570f-4293-8f4c-9331389dd100/

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories