The vulnerability is a broken access control flaw where users with the subscriber role can reach administrative functions of the Classified Listing plugin that should be restricted to higher‑privilege roles. This allows an attacker to modify, delete, or otherwise tamper with listings, compromising data integrity and potentially exposing sensitive information. The weakness aligns with CWE‑862, which indicates a missing authorization check.

The flaw exists in the WordPress Classified Listing plugin by Mamunur Rashid for all versions up to and including 5.3.9. Deployments running these versions on WordPress sites are affected.

The CVSS score of 6.3 suggests a moderate severity with the main vector being the web interface accessed by authenticated users. EPSS indicates a low exploitation probability (<1%), and the flaw is not listed in CISA’s KEV catalog. Still, because the control is broken for a common role, the risk to a site that relies on the plugin’s integrity is real, especially if subscriber accounts are widely distributed. The typical exploitation path involves an attacker logging in as a subscriber and then calling restricted API endpoints or manipulating URLs to perform privileged operations.