CVE-2025-7711: WordPress Classified Listing Plugin RCE Flaw

CVE-2025-7711 Overview

CVE-2025-7711 affects the Classified Listing – Classified ads & Business Directory Plugin for WordPress in all versions up to and including 5.0.3. The plugin passes user-supplied input to do_shortcode without proper validation, allowing authenticated attackers with Subscriber-level access or higher to execute arbitrary shortcodes. This weakness maps to CWE-94: Improper Control of Generation of Code. Because WordPress sites frequently permit open subscriber registration, the barrier to exploitation is low on many public deployments.

Critical Impact
Authenticated Subscriber-level users can trigger arbitrary shortcode execution, potentially exposing restricted content, invoking privileged plugin functionality, or facilitating broader site compromise.

Affected Products

WordPress Classified Listing – Classified ads & Business Directory Plugin, versions ≤ 5.0.3
WordPress sites permitting Subscriber-level registration with the plugin installed
Any downstream shortcodes registered by other plugins on the same site

Discovery Timeline

2025-11-17 - CVE-2025-7711 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-7711

Vulnerability Analysis

The vulnerability lives in the plugin's filter hook handling logic, specifically referenced at app/Controllers/Hooks/FilterHooks.php line 367 in the 5.0.2 source tree. The affected code path accepts a value influenced by the request and forwards it to WordPress's do_shortcode function without sanitizing or restricting the allowed shortcode tags.

WordPress do_shortcode parses bracketed tags and executes any registered shortcode handler. When attacker-controlled input reaches this function, the attacker can invoke any shortcode registered by WordPress core, active themes, or other installed plugins. The resulting behavior depends on which shortcodes exist on the target site, but common outcomes include disclosing gated content, listing users, or invoking administrative helpers exposed through shortcodes.

The issue requires authentication at Subscriber level. WordPress installations that permit open registration effectively expose this to any unauthenticated adversary willing to register an account.

Root Cause

The root cause is missing input validation before dynamic code execution. The plugin trusts a request-supplied value and treats it as safe shortcode markup. No allowlist restricts which shortcodes may be executed through this path, and no capability check gates the operation beyond baseline authentication.

Attack Vector

An attacker authenticates as a Subscriber, then submits a crafted request containing shortcode markup in the vulnerable parameter. The server passes the value to do_shortcode, which resolves and executes the shortcode. Because the attack is delivered over standard HTTP requests, no user interaction or elevated privileges are required beyond the low-level authenticated role. See the Wordfence Vulnerability Report and the WordPress Filter Hooks Code for the affected code path.

Detection Methods for CVE-2025-7711

Indicators of Compromise

Web server access logs showing authenticated POST or GET requests to Classified Listing plugin endpoints containing bracketed shortcode syntax ([shortcode ...]) in parameter values.
Unexpected content rendered on plugin-driven pages that resolves to shortcodes registered by unrelated plugins.
New or recently registered low-privilege accounts issuing repeated requests to plugin filter hook handlers.

Detection Strategies

Inspect the plugin filter path around FilterHooks.php line 367 and audit request parameters for shortcode delimiters before they reach do_shortcode.
Correlate WordPress user role data with request logs to flag Subscriber-level users invoking plugin actions that render dynamic content.
Deploy a web application firewall rule that identifies shortcode-bracket patterns in request bodies destined for the Classified Listing endpoints.

Monitoring Recommendations

Alert on newly created Subscriber accounts followed by requests containing [ and ] payloads to plugin URLs.
Track invocations of sensitive shortcodes (user listings, private content, form handlers) with source-IP and account attribution.
Monitor plugin version drift across managed WordPress fleets to identify hosts still running versions at or below 5.0.3.

How to Mitigate CVE-2025-7711

Immediate Actions Required

Update the Classified Listing plugin to a version later than 5.0.3 as soon as the vendor publishes a fixed release.
Audit existing Subscriber accounts and remove any that are unrecognized or created during the exposure window.
Temporarily disable open user registration on affected sites if it is not required by business function.

Patch Information

The advisory identifies all versions up to and including 5.0.3 as vulnerable. Apply the vendor-supplied fixed release referenced in the Wordfence Vulnerability Report. Review the plugin changelog to confirm that the fix restricts input passed to do_shortcode and enforces capability checks on the affected filter hook.

Workarounds

Deactivate the Classified Listing plugin until a patched version is installed if the affected functionality is not business-critical.
Restrict access to plugin endpoints via WAF rules that drop requests containing shortcode brackets from non-administrative users.
Set users_can_register to false in WordPress general settings to eliminate the primary path to obtaining Subscriber credentials.

bash

# Disable open registration via WP-CLI
wp option update users_can_register 0

# Deactivate the vulnerable plugin until patched
wp plugin deactivate classified-listing

# List Subscriber accounts for review
wp user list --role=subscriber --fields=ID,user_login,user_registered