CVE-2025-12953 Overview
CVE-2025-12953 is a missing authorization vulnerability in the Classified Listing – AI-Powered Classified ads & Business Directory Plugin for WordPress. The plugin fails to enforce capability checks on three AJAX handlers: rtcl_ajax_add_listing_type, rtcl_ajax_update_listing_type, and rtcl_ajax_delete_listing_type. Authenticated users with subscriber-level access or higher can add, modify, or delete listing types without authorization. All plugin versions up to and including 5.2.0 are affected. The flaw is tracked under CWE-862: Missing Authorization.
Critical Impact
Any authenticated WordPress user, including low-privilege subscribers, can manipulate listing type configurations on affected sites, disrupting directory content integrity.
Affected Products
- Classified Listing – AI-Powered Classified ads & Business Directory Plugin for WordPress
- All versions up to and including 5.2.0
- WordPress sites permitting subscriber-level registration
Discovery Timeline
- 2025-11-11 - CVE-2025-12953 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-12953
Vulnerability Analysis
The vulnerability affects the AjaxListingType.php controller in the Classified Listing plugin. Three AJAX endpoints handle listing type management: creation, update, and deletion. The endpoints register handlers accessible to any authenticated WordPress user through the wp_ajax_ action hook. The handlers do not verify whether the calling user holds administrative capabilities such as manage_options or a plugin-specific role.
An attacker with a subscriber account can invoke these endpoints by sending crafted POST requests to wp-admin/admin-ajax.php. The plugin processes the requests and modifies the listing type taxonomy without rejecting the caller. This breaks the intended trust boundary that restricts directory configuration to site administrators. See the WordPress Trac Changeset for the corrective patch and the Wordfence Vulnerability Analysis for the disclosure record.
Root Cause
The root cause is the absence of a current_user_can() capability check inside each of the three AJAX handler functions. WordPress plugin developers must gate privileged operations with explicit capability enforcement. Nonce validation alone, if present, only protects against cross-site request forgery. It does not authorize the requesting user.
Attack Vector
The attack requires network access to the WordPress site and a valid low-privilege authenticated session. The attacker submits an HTTP POST request to the vulnerable AJAX action with the required parameters for adding, updating, or deleting a listing type. No user interaction from an administrator is required. Successful exploitation modifies plugin data structures used across the directory.
The vulnerability manifests through unauthenticated capability enforcement in the AJAX request handlers. Refer to the referenced Trac changeset for the exact code path and remediation.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2025-12953
Indicators of Compromise
- Unexpected creation, modification, or removal of listing types in the Classified Listing plugin taxonomy
- POST requests to /wp-admin/admin-ajax.php with the action parameter set to rtcl_ajax_add_listing_type, rtcl_ajax_update_listing_type, or rtcl_ajax_delete_listing_type originating from non-administrator accounts
- Audit log entries showing listing type changes attributed to subscriber or contributor accounts
Detection Strategies
- Review web server access logs for AJAX requests targeting the three affected rtcl_ajax_* actions and correlate the source user cookie against WordPress user roles
- Enable a WordPress audit logging plugin to record taxonomy and plugin option changes with acting user identity
- Compare current listing type configurations against a known-good baseline to identify unauthorized modifications
Monitoring Recommendations
- Monitor for spikes in admin-ajax.php traffic from newly registered subscriber accounts
- Alert on new user registrations followed within a short window by AJAX calls to plugin-specific actions
- Track database changes to Classified Listing plugin tables and taxonomy terms
How to Mitigate CVE-2025-12953
Immediate Actions Required
- Update the Classified Listing plugin to the version released after 5.2.0 that includes the fix from changeset 3389342
- Audit existing listing types for unauthorized additions, modifications, or deletions and restore from backup if tampering is found
- Review the WordPress user list and remove or downgrade unrecognized subscriber accounts
Patch Information
The vendor addressed the vulnerability in the plugin update following version 5.2.0. The fix adds capability checks to the rtcl_ajax_add_listing_type, rtcl_ajax_update_listing_type, and rtcl_ajax_delete_listing_type handlers in app/Controllers/Ajax/AjaxListingType.php. Site administrators should apply the update through the WordPress plugin dashboard or via WP-CLI.
Workarounds
- Disable open user registration on the WordPress site until the patch is applied by setting Settings > General > Membership to unchecked
- Temporarily deactivate the Classified Listing plugin if patching cannot be performed immediately
- Restrict access to /wp-admin/admin-ajax.php for the three vulnerable actions using a Web Application Firewall rule
# Configuration example: disable open registration via WP-CLI
wp option update users_can_register 0
# Verify installed plugin version
wp plugin get classified-listing --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
