The Classified Listing plugin by Mamunur Rashid contains a missing authorization check that allows access to functionality not properly constrained by access control lists. This flaw leaves the plugin vulnerable to unauthorized use of its endpoints. The impact is an authorization bypass that could affect data integrity and availability, although the precise extent depends on which features are accessed.

All WordPress installations that have the Classified Listing plugin v6.1.1 or earlier are affected. No specific WordPress core versions are mentioned, so the issue resides solely within the plugin code.

The CVSS score of 5.4 indicates moderate severity. The EPSS score is not available, and the official description does not detail the attack vector. Based on the nature of the missing authorization check in plugin code, it is inferred that an attacker could exploit this by sending unauthenticated HTTP requests to the plugin’s endpoints, but this inference is not explicitly confirmed by the description. The vulnerability is not listed in CISA’s KEV catalog, suggesting no widespread exploitation has been reported. Nevertheless, the potential to bypass access controls remains a significant concern for sites that rely on the plugin for critical listing operations.