The vulnerability is a broken access control flaw in WordPress Classified Listing plugin up to version 5.4.2. This is a CWE-862: Broken Access Control weakness. Subscribers are able to view and modify listings that should be restricted, enabling them to create, edit, or delete listings without proper authorization. site's classified content.

RadiusTheme's Classified Listing plugin versions 5.4.2 and older are affected. Site owners running any of these releases must verify their WordPress installation and update if the plugin is present.

The CVSS score of 6.5 indicates a moderate severity. The EPSS score of < 1% indicates a very low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that attackers likely need to be authenticated subscribers to exploit the flaw, so the attack vector is the web application with an existing user session. Once a subscriber account is compromised or created, the attacker can gain unauthorized control over listings, potentially leading to defacement or fraudulent activity.