CVE-2026-106646 Overview
CVE-2026-106646 is a missing authorization vulnerability [CWE-862] in the Classified Listing WordPress plugin versions before 6.1.1. The plugin fails to verify that the requester owns or can edit the target listing when a gallery request references an unattached media item. Any authenticated user with a subscriber-level account can modify, corrupt, or delete media-library attachments owned by other users, including administrators. The flaw enables cross-user tampering with WordPress media assets without requiring elevated privileges.
Critical Impact
Subscriber-level accounts can delete or corrupt media-library attachments belonging to administrators, compromising site integrity and content availability.
Affected Products
- Classified Listing WordPress plugin versions prior to 6.1.1
Discovery Timeline
- 2026-10-14 - CVE-2026-106646 published to NVD
- 2026-10-14 - Last updated in NVD database
Technical Details for CVE-2026-106646
Vulnerability Analysis
The Classified Listing plugin processes gallery requests that reference media-library attachments via attachment IDs. When a request targets an unattached media item, the plugin does not confirm that the requesting user owns or has edit rights over the targeted listing or attachment. The result is a broken access control condition that permits horizontal and vertical object tampering across user boundaries.
An authenticated subscriber can submit crafted gallery operations that act on arbitrary attachment IDs. Because the authorization check is absent, the plugin executes the requested modification, replacement, or deletion against media owned by other accounts, including administrators. The vulnerability is tracked under CWE-862: Missing Authorization.
Root Cause
The root cause is a missing capability check in the gallery request handler. The code path assumes that any authenticated caller supplying an attachment ID has legitimate access to that attachment. It omits WordPress capability functions such as current_user_can('edit_post', $attachment_id) before performing destructive or mutating operations on unattached media.
Attack Vector
Exploitation requires a valid subscriber-level account on the target WordPress site, which is trivially obtainable where open registration is enabled. The attacker issues an authenticated request to the plugin's gallery endpoint, referencing attachment IDs owned by other users. The server performs the requested modification without validating ownership, enabling integrity loss across the media library.
No exploitation code is published in the referenced advisory. Technical details are available in the WPScan Vulnerability Report.
Detection Methods for CVE-2026-106646
Indicators of Compromise
- Unexpected modification, replacement, or deletion of media-library attachments owned by administrators or editors.
- Authenticated requests to Classified Listing gallery endpoints originating from subscriber accounts referencing attachment IDs the user does not own.
- Entries in WordPress audit logs showing attachment metadata changes without a corresponding administrative action.
Detection Strategies
- Review web server access logs for POST requests to Classified Listing gallery handlers from low-privilege user sessions.
- Correlate attachment deletion or update events in the wp_posts and wp_postmeta tables with the acting user ID to identify ownership mismatches.
- Deploy a WordPress audit-logging plugin to record attachment lifecycle events and the user context performing them.
Monitoring Recommendations
- Monitor subscriber-role account creation rates for anomalous spikes that may indicate preparation for exploitation.
- Alert on bulk media deletions or modifications occurring within short time windows from a single session.
- Track plugin version inventory across managed WordPress sites to confirm Classified Listing is upgraded to 6.1.1 or later.
How to Mitigate CVE-2026-106646
Immediate Actions Required
- Upgrade the Classified Listing plugin to version 6.1.1 or later on all WordPress installations.
- Audit the media library for unexpected changes to administrator-owned attachments and restore from backups where tampering is confirmed.
- Temporarily disable open user registration if the site does not require self-service subscriber accounts.
Patch Information
The vulnerability is resolved in Classified Listing version 6.1.1. Review the vendor fix details in the WPScan Vulnerability Report and apply the update through the WordPress plugin administration interface or by replacing the plugin files directly.
Workarounds
- Disable the Classified Listing plugin until the patched version can be deployed.
- Restrict subscriber-role creation by requiring administrator approval for new accounts.
- Apply a web application firewall rule that blocks gallery requests referencing attachment IDs not owned by the authenticated requester.
# Configuration example: upgrade plugin via WP-CLI
wp plugin update classified-listing --version=6.1.1
wp plugin list --name=classified-listing --fields=name,status,version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.