The Classified Listing plugin exposes an AJAX handler that allows any authenticated user with Subscriber-level access or higher to set the featured image of any listing, regardless of ownership. The handler accepts user-supplied listing and attachment identifiers and relies only on a nonce that is publicly available in the front‑end submission form. This omission of an ownership or capability check means an attacker can arbitrarily change the featured image for listings they do not own, potentially defacing content or misleading users. The weakness is a classic missing authorization flaw, identified as CWE‑862.

Any WordPress site running the Classified Listing plugin version 5.4.2 or earlier, deployed by the vendor techlabpro1, is affected. The vulnerability exists in all releases up to and including 5.4.2; newer releases are not impacted.

The CVSS score of 4.3 indicates a moderate impact with limited damage potential, but the attack requires only basic login credentials and the ability to access the front‑end listing submission form. No exploitation proof code is required as the flaw relies on normal AJAX interactions. EPSS is not available and the vulnerability is not listed in CISA’s KEV catalog, suggesting it has limited currently observed exploitation. The likely attack vector is a logged‑in user performing a standard AJAX request from the site’s client side, making it straightforward to exploit in a typical WordPress environment.