PT-2026-41278 · WordPress · Classified Listing

Momopon1415 · Published 2026-05-15 · Updated 2026-05-15 · CVE-2026-7563

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Classified Listing – AI-Powered Classified ads & Business Directory Plugin versions prior to 5.3.11

Description The plugin fails to properly verify user authorization for certain actions. This allows authenticated attackers with subscriber-level access or higher to add arbitrary notes to any order and trigger unsolicited notification and moderation emails to listing owners without administrative authorization. This is achieved through the AJAX actions add order note and send email to user by moderator.

Recommendations Update to a version later than 5.3.10.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-7563

Affected Products

Classified Listing

References · 16

• https://nvd.nist.gov/vuln/detail/CVE-2026-7563 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/07cb3d57-d768-49a5-8af0-9dc4384487d5?source=cve · Note
• https://plugins.trac.wordpress.org/browser/classified-listing/tags/5.3.7/app/Controllers/Hooks/Comments.php#L63 · Note
• https://plugins.trac.wordpress.org/browser/classified-listing/trunk/app/Controllers/Hooks/Comments.php#L51 · Note
• https://plugins.trac.wordpress.org/browser/classified-listing/trunk/app/Controllers/Admin/ScriptLoader.php#L672 · Note
• https://plugins.trac.wordpress.org/browser/classified-listing/tags/5.3.7/app/Controllers/Ajax/ListingAdminAjax.php#L48 · Note
• https://plugins.trac.wordpress.org/browser/classified-listing/tags/5.3.10/app/Controllers/Hooks/Comments.php#L63 · Note
• https://plugins.trac.wordpress.org/changeset/3527717 · Note
• https://plugins.trac.wordpress.org/browser/classified-listing/tags/5.3.7/app/Controllers/Hooks/Comments.php#L51 · Note
• https://plugins.trac.wordpress.org/browser/classified-listing/tags/5.3.7/app/Controllers/Admin/ScriptLoader.php#L672 · Note
• https://plugins.trac.wordpress.org/browser/classified-listing/trunk/app/Controllers/Ajax/ListingAdminAjax.php#L48 · Note
• https://plugins.trac.wordpress.org/browser/classified-listing/tags/5.3.10/app/Controllers/Admin/ScriptLoader.php#L672 · Note
• https://plugins.trac.wordpress.org/browser/classified-listing/tags/5.3.10/app/Controllers/Ajax/ListingAdminAjax.php#L48 · Note
• https://plugins.trac.wordpress.org/browser/classified-listing/trunk/app/Controllers/Hooks/Comments.php#L63 · Note
• https://plugins.trac.wordpress.org/browser/classified-listing/tags/5.3.10/app/Controllers/Hooks/Comments.php#L51 · Note