CVE-2026-57355: Classified Listing Auth Bypass Vulnerability

CVE-2026-57355 Overview

CVE-2026-57355 is a broken access control vulnerability in the WordPress Classified Listing plugin affecting versions up to and including 5.4.2. The flaw allows authenticated users with Subscriber-level privileges to perform actions that should be restricted to higher-privilege roles. The weakness is classified under CWE-862: Missing Authorization.

An attacker with a valid Subscriber account can exploit this issue over the network without user interaction. The vulnerability impacts data integrity on affected WordPress installations running the Classified Listing plugin.

Critical Impact
Authenticated Subscriber accounts can bypass authorization checks in the Classified Listing plugin, enabling unauthorized modification of listing data on affected WordPress sites.

Affected Products

WordPress Classified Listing plugin versions 5.4.2 and earlier
WordPress installations with the vulnerable plugin active
Sites permitting Subscriber-level user registration

Discovery Timeline

2026-07-02 - CVE-2026-57355 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-57355

Vulnerability Analysis

The Classified Listing plugin exposes functionality that lacks proper authorization checks. Endpoints intended for higher-privileged users are reachable by any authenticated Subscriber. This maps to CWE-862: Missing Authorization.

Exploitation requires only a valid low-privilege account, which is trivial to obtain on sites that permit open registration. The attack targets the integrity of classified listing data, allowing unauthorized create, modify, or state-change operations. Confidentiality and availability are not directly affected.

Root Cause

The plugin fails to enforce capability checks on sensitive actions. WordPress plugins typically validate user capabilities using functions such as current_user_can() before executing privileged operations. When these checks are missing or evaluate an insufficient capability, users with the default Subscriber role gain access to actions reserved for editors, authors, or administrators.

Attack Vector

The attack is executed over the network against the WordPress site hosting the vulnerable plugin. An attacker registers or uses an existing Subscriber account, authenticates, then issues crafted requests to the affected plugin endpoints. Because the vulnerable handlers omit authorization enforcement, the requests succeed and mutate listing data without administrator approval.

No authenticated code execution is required beyond standard HTTP requests to plugin-registered actions or REST routes. Refer to the Patchstack Vulnerability Report for advisory details.

Detection Methods for CVE-2026-57355

Indicators of Compromise

Unexpected creation or modification of classified listings by low-privilege Subscriber accounts
HTTP POST requests from Subscriber sessions to plugin admin-ajax or REST endpoints associated with classified-listing
New or altered listing records without corresponding administrator or editor activity in WordPress audit logs

Detection Strategies

Review WordPress user activity logs for Subscriber accounts performing listing management actions
Correlate web server access logs with plugin endpoint URIs to identify requests from non-privileged sessions
Baseline normal Subscriber behavior and alert on deviations involving plugin-specific action parameters

Monitoring Recommendations

Enable a WordPress audit logging plugin to capture role-based action history
Monitor the wp_posts and plugin-specific tables for changes attributed to Subscriber user IDs
Track registration spikes followed by immediate plugin endpoint access, which may indicate automated exploitation

How to Mitigate CVE-2026-57355

Immediate Actions Required

Update the Classified Listing plugin to a version later than 5.4.2 as soon as the vendor publishes a fixed release
Audit existing Subscriber accounts and remove any that are unrecognized or inactive
Restrict new user registration or require administrator approval for new accounts until patched

Patch Information

Consult the Patchstack Vulnerability Report for the latest patched version and remediation guidance. Apply the vendor-supplied update through the WordPress plugin manager or by replacing the plugin files with the patched release.

Workarounds

Temporarily deactivate the Classified Listing plugin until a patched version is installed
Disable open user registration by unchecking Anyone can register under Settings > General
Deploy a web application firewall rule blocking Subscriber-authenticated requests to sensitive Classified Listing endpoints

bash

# Disable WordPress open registration via WP-CLI
wp option update users_can_register 0

# List and audit Subscriber accounts
wp user list --role=subscriber --fields=ID,user_login,user_registered

# Deactivate the vulnerable plugin until patched
wp plugin deactivate classified-listing