The Classified Listing plugin for WordPress fails to verify that a user has the necessary permissions before executing certain AJAX actions. The flaw allows authenticated users with subscriber-level or higher privileges to add arbitrary notes to any order and to trigger unsolicited notification and moderation emails to listing owners without administrative approval. This lack of proper authorization leads to unauthorized data modification and potential information disclosure through email notifications.

WordPress sites running techlabpro1 Classified Listing – AI-Powered Classified ads & Business Directory Plugin versions up to and including 5.3.10 are susceptible. The vulnerability is present across all prior releases and is mitigated only in future versions beyond 5.3.10.

The CVSS score of 4.3 indicates a moderate impact, and the EPSS score is not available, suggesting limited public exploitation data. The issue is not listed in CISA KEV. Attackers need only an authenticated account with subscriber or higher role to exploit the flaw, making the attack path relatively straightforward for sites that have granted broader access to non-administrative users.