The Classified Listing plugin for WordPress lacks a capability check on its AJAX endpoints that manage listing types. As a result, any user who has subscriber or higher privileges can add, alter, or delete listing types without restriction. This flaw allows an attacker to change the structure and behavior of listings, potentially compromising the integrity of the directory and enabling malicious content or misrepresenting services.

WordPress sites using the Classified Listing – AI‑Powered Classified ads & Business Directory Plugin up to and including version 5.2.0 are affected. The vulnerability is present in all releases in that range, regardless of host configuration.

The CVSS score of 4.3 indicates low severity from a technical standpoint, and the EPSS score of less than 1% signals a very low likelihood of exploitation. The flaw is not listed in the CISA KEV catalog. Because the attack requires only subscriber‑level authentication, a legitimate user account is sufficient to exploit the weakness, making it a straightforward privilege‑escalation scenario for anyone with those basic access rights. The impact primarily concerns data integrity and possible abuse of the directory feature.