CVE-2026-42651: Classified Listing Auth Bypass Vulnerability

CVE-2026-42651 Overview

CVE-2026-42651 is a broken access control vulnerability affecting the Classified Listing WordPress plugin in versions up to and including 5.3.9. The flaw maps to [CWE-862] Missing Authorization and allows authenticated users with subscriber-level privileges to access functionality that should be restricted to higher-privileged roles. The vulnerability requires low-privilege network access and no user interaction.

Critical Impact
Authenticated subscribers can bypass access controls in the Classified Listing plugin, leading to limited compromise of confidentiality, integrity, and availability on affected WordPress sites.

Affected Products

Classified Listing WordPress plugin versions <= 5.3.9
WordPress sites with subscriber registration enabled
Any deployment exposing the plugin's restricted endpoints to authenticated users

Discovery Timeline

2026-06-15 - CVE-2026-42651 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-42651

Vulnerability Analysis

The vulnerability stems from missing authorization checks in the Classified Listing plugin. The plugin exposes functionality intended for elevated roles without verifying that the requesting user holds the appropriate capability. Subscribers, the lowest privileged authenticated role in WordPress, can invoke these actions and influence data outside their permission scope.

The weakness aligns with [CWE-862] Missing Authorization. The plugin authenticates the user session but fails to enforce role or capability checks on sensitive request handlers. This is a common pattern in WordPress plugins that rely on is_user_logged_in() rather than current_user_can() for gating actions.

The impact is bounded to limited confidentiality, integrity, and availability effects, consistent with subscriber-level access to plugin-managed listings, settings, or metadata.

Root Cause

The root cause is the absence of capability verification on plugin request handlers. The code path executes privileged operations after confirming only that the request originates from an authenticated session. Any registered user, including self-registered subscribers, can reach the affected handlers.

Attack Vector

An attacker first obtains subscriber credentials. On sites that permit open registration, this step requires no exploitation. The attacker then issues HTTP requests to the plugin's vulnerable endpoints, invoking actions that should require editor or administrator capabilities. The attack is fully remote and does not require user interaction.

No verified public exploit code is available. Refer to the Patchstack Vulnerability Report for additional technical detail.

Detection Methods for CVE-2026-42651

Indicators of Compromise

Unexpected POST or AJAX requests to Classified Listing plugin endpoints originating from subscriber accounts
New, modified, or deleted classified listings without corresponding editor or administrator actions in audit logs
Subscriber accounts performing repeated requests against admin-ajax.php with plugin-specific action parameters

Detection Strategies

Inspect web server access logs for authenticated requests to Classified Listing endpoints from users whose role is subscriber
Correlate WordPress user activity logs against capability assignments to identify privilege boundary violations
Alert on creation of subscriber accounts followed shortly by access to plugin administrative actions

Monitoring Recommendations

Enable a WordPress audit logging plugin to capture role-based action attribution
Monitor request rates to wp-admin/admin-ajax.php and wp-json/ routes exposed by the plugin
Track the plugin version inventory across managed WordPress sites to identify hosts still running <= 5.3.9

How to Mitigate CVE-2026-42651

Immediate Actions Required

Update the Classified Listing plugin to a version above 5.3.9 as soon as the vendor releases a patched build
Audit subscriber accounts and disable open user registration on sites that do not require it
Review recent plugin-related activity in audit logs for signs of abuse

Patch Information

A fix should be applied by upgrading the Classified Listing plugin beyond version 5.3.9. Consult the Patchstack Vulnerability Report for current fixed version information.

Workarounds

Restrict access to the WordPress admin and AJAX endpoints by IP allowlist where feasible
Disable the Classified Listing plugin until a patched version is installed if subscriber registration cannot be turned off
Deploy a Web Application Firewall (WAF) rule blocking unauthorized plugin action parameters from low-privilege sessions

bash

# Example: disable open registration via wp-cli until patched
wp option update users_can_register 0

# Verify Classified Listing plugin version
wp plugin get classified-listing --field=version

# Deactivate the plugin if running a vulnerable version
wp plugin deactivate classified-listing