CVE-2026-84217: Classified Listing Auth Bypass Vulnerability

CVE-2026-84217 Overview

CVE-2026-84217 is a missing authorization vulnerability in the Mamunur Rashid Classified Listing plugin for WordPress. The flaw affects all versions from initial release through 6.1.1. It stems from broken access control [CWE-862], where the plugin fails to properly restrict functionality behind access control lists (ACLs). Authenticated attackers with low privileges can reach plugin functionality that should be limited to higher-privileged roles. Successful exploitation impacts integrity and availability of the affected WordPress site.

Critical Impact
Authenticated low-privilege users can invoke Classified Listing plugin functions that are not protected by proper authorization checks, enabling limited tampering and disruption of site data.

Affected Products

Mamunur Rashid Classified Listing plugin for WordPress
All versions from initial release through 6.1.1
WordPress sites using the plugin without the vendor patch applied

Discovery Timeline

2026-09-02 - CVE-2026-84217 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-84217

Vulnerability Analysis

The Classified Listing plugin exposes actions that lack sufficient authorization checks. WordPress plugins typically enforce capability checks with functions such as current_user_can() or verify nonces through check_ajax_referer(). When these checks are missing or applied inconsistently, requests from low-privilege authenticated users reach code paths intended for administrators or listing owners.

The attack requires network access and low privileges without user interaction. The scope remains unchanged, and confidentiality is not directly impacted. Integrity and availability are partially affected because an attacker can alter or disrupt plugin-managed data. Refer to the Patchstack Vulnerability Report for vendor-tracked details.

Root Cause

The root cause is missing or insufficient authorization enforcement on plugin endpoints. The plugin trusts the authenticated session without validating that the caller holds the capability required for the requested action. This is a classic broken access control pattern tracked as [CWE-862].

Attack Vector

An attacker authenticates to the WordPress site with any low-privilege account, such as a subscriber or standard registered user. The attacker then sends crafted HTTP requests directly to the vulnerable plugin endpoints. Because the plugin does not verify the caller's role or ownership, the requests execute successfully and modify or disrupt plugin state.

// No verified proof-of-concept code is published for CVE-2026-84217.
// See the Patchstack advisory linked above for vendor-tracked details.

Detection Methods for CVE-2026-84217

Indicators of Compromise

Unexpected creation, modification, or deletion of classified listings by low-privilege user accounts
WordPress audit log entries showing subscriber-level accounts invoking plugin AJAX or REST endpoints tied to listing management
HTTP POST requests to Classified Listing plugin endpoints originating from accounts that do not own the target listing

Detection Strategies

Review WordPress access logs for requests to admin-ajax.php or plugin REST routes that reference Classified Listing actions from non-administrator sessions
Correlate authenticated session activity with listing state changes to identify unauthorized modifications
Alert on privilege-boundary violations where user roles perform actions reserved for editors, administrators, or listing owners

Monitoring Recommendations

Enable a WordPress audit logging plugin to record capability checks, role changes, and content modifications
Forward web server and WordPress logs to a centralized SIEM for retention and query
Monitor plugin version inventory across WordPress installations to identify hosts still running Classified Listing 6.1.1 or earlier

How to Mitigate CVE-2026-84217

Immediate Actions Required

Identify all WordPress sites running the Classified Listing plugin and confirm the installed version
Update the Classified Listing plugin to a version later than 6.1.1 once the vendor releases a fix
Audit recent listing changes and user activity for signs of unauthorized modifications
Restrict new user registration or require administrator approval on sites where registration is not essential

Patch Information

The vulnerability affects Classified Listing through version 6.1.1. Consult the Patchstack Vulnerability Report and the plugin's official WordPress.org page for the current fixed version and upgrade instructions.

Workarounds

Deactivate the Classified Listing plugin until a patched version is installed if the site can tolerate the downtime
Deploy a Web Application Firewall (WAF) rule to block requests to vulnerable plugin endpoints from non-administrator sessions
Reduce the attack surface by limiting registration to trusted users and enforcing strong authentication

bash

# Example: list WordPress sites running vulnerable Classified Listing versions using WP-CLI
wp plugin get classified-listing --field=version
# Update to the fixed release once available
wp plugin update classified-listing