The Classified Listing plugin by Mamunur Rashid contains a Missing Authorization vulnerability that allows access to functionality not properly constrained by access control lists. This flaw leaves the plugin vulnerable to unauthorized use of its endpoints, potentially affecting data integrity and availability depending on the accessed features.

All WordPress installations that have the Classified Listing plugin version 6.1.3 or earlier are affected. No specific WordPress core versions are mentioned, so the issue resides solely within the plugin code.

The CVSS score of 5.4 indicates moderate severity. The EPSS score is < 1%, indicating low exploitation probability, and the official description does not detail the attack vector. Based on the nature of the missing authorization check in plugin code, it is inferred that an attacker could exploit this by sending unauthenticated HTTP requests to the plugin’s endpoints, but this inference is not explicitly confirmed by the description. The vulnerability is not listed in CISA’s KEV catalog, suggesting no widespread exploitation has been reported. Nevertheless, the potential to bypass access controls remains a significant concern for sites that rely on the plugin for critical listing operations.