The Classified Listing WordPress plugin, in any version prior to 6.1.1, lacks a check that the requester is the owner or has permission to edit a listing. When an authenticated user requests a gallery AJAX handler that references an unattached media item, the plugin permits the user to modify, corrupt, or delete media‑library attachments owned by other users, including administrators. This flaw results in loss of integrity for the media library and allows a subscriber‑level user to manipulate site media without appropriate authorization, representing a broken access‑control vulnerability.

The flaw targets installations of the Classified Listing WordPress plugin with versions earlier than 6.1.1. Any WordPress site that has installed this plugin prior to the fixed release is potentially affected.

Exploitation requires only an authenticated session with a subscriber role and access to the gallery AJAX endpoint. The CVSS score of 5.9 reflects moderate severity, and an EPSS score of less than 1% indicates a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Because subscriber accounts are commonly present on WordPress sites, the overall risk is moderate until the plugin is updated or mitigated.