CVE-2025-58601 Overview
CVE-2025-58601 is a Missing Authorization vulnerability [CWE-862] in the RadiusTheme Classified Listing plugin for WordPress. The flaw affects all versions up to and including 5.0.6. An authenticated attacker with low privileges can exploit incorrectly configured access control security levels to access functionality or data intended for higher-privileged users.
The vulnerability is exploitable over the network with low complexity and requires no user interaction. Successful exploitation impacts data integrity but does not directly compromise confidentiality or availability.
Critical Impact
Authenticated users with minimal privileges can perform actions restricted to higher-privileged roles due to broken access control in the Classified Listing plugin.
Affected Products
- RadiusTheme Classified Listing plugin for WordPress
- Versions from n/a through 5.0.6
- WordPress sites with the classified-listing plugin installed and active
Discovery Timeline
- 2025-09-03 - CVE-2025-58601 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-58601
Vulnerability Analysis
The vulnerability stems from missing authorization checks in the Classified Listing plugin. The plugin exposes functionality that fails to validate whether the requesting user holds the required capability or role before executing sensitive operations. This falls under Broken Access Control, categorized as [CWE-862] Missing Authorization.
An attacker holding a low-privileged authenticated account, such as a subscriber, can invoke endpoints or actions that should be restricted to editors, administrators, or listing owners. This enables limited modification of plugin-managed data. The scope remains unchanged, and the impact focuses on integrity rather than confidentiality or availability.
Root Cause
The root cause is the absence of proper capability checks in one or more request handlers within the classified-listing plugin. Access control decisions rely on incorrectly configured security levels rather than explicit current_user_can() verification tied to the affected resource. Authenticated requests bypass intended restrictions.
Attack Vector
The attack vector is network-based. An attacker authenticates to the target WordPress instance with a low-privileged account, then issues crafted HTTP requests to plugin endpoints that lack authorization enforcement. No user interaction is required. Refer to the Patchstack Vulnerability Report for advisory details.
No public proof-of-concept exploit code is currently listed for this issue.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2025-58601
Indicators of Compromise
- Unexpected modifications to classified listings, categories, or plugin settings performed by non-administrative accounts.
- HTTP requests to classified-listing plugin endpoints originating from subscriber-level or newly registered accounts.
- Anomalous POST or AJAX traffic to admin-ajax.php referencing classified-listing actions from low-privileged sessions.
Detection Strategies
- Audit WordPress activity logs for actions performed by users whose roles should not permit those actions on the plugin.
- Compare plugin data state against known-good backups to identify unauthorized changes.
- Review web server access logs for repeated requests to plugin AJAX or REST endpoints followed by state changes.
Monitoring Recommendations
- Enable a WordPress audit logging plugin to capture user role, action, and affected object for every plugin request.
- Alert on privilege-sensitive actions performed by accounts below the expected role threshold.
- Monitor for creation of new subscriber accounts followed by immediate interaction with classified-listing endpoints.
How to Mitigate CVE-2025-58601
Immediate Actions Required
- Identify all WordPress sites running the RadiusTheme Classified Listing plugin at version 5.0.6 or earlier.
- Apply the vendor patch as soon as an updated release is available from RadiusTheme.
- Restrict user registration and review existing low-privileged accounts for legitimacy.
- Review the Patchstack advisory for the latest fixed version guidance.
Patch Information
The vulnerability affects Classified Listing versions up to and including 5.0.6. Administrators should upgrade to a version higher than 5.0.6 once RadiusTheme publishes a patched release. Consult the vendor's WordPress.org plugin page and the linked Patchstack advisory for the current fixed version.
Workarounds
- Disable the Classified Listing plugin until a patched version is installed if the site does not depend on it.
- Restrict access to admin-ajax.php and plugin REST endpoints via a web application firewall (WAF) rule that blocks unauthorized role usage.
- Temporarily disable open user registration to reduce the pool of low-privileged accounts available to attackers.
- Enforce strong authentication and multi-factor authentication (MFA) for all WordPress accounts to raise the exploitation bar.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
