The Classified Listing plugin for WordPress contains a missing authorization vulnerability (CWE-862) in the 'rtcl_import_settings' function. Authenticated users with Subscriber-level permissions can exploit this flaw to modify limited arbitrary options on the site. By doing so, they can escalate their privileges to Administrator level, gaining full control over the WordPress site. The vulnerability affects all versions up to and including 3.1.15.1. The exploit requires the updated option to be an array value. There is no indication of known exploits in the wild or an official patch at this time.

Successful exploitation allows an authenticated low-privilege user (Subscriber or above) to escalate privileges to Administrator, resulting in full control over the affected WordPress site. This includes the ability to modify site settings, install plugins, change content, and potentially compromise the entire site and its data. The vulnerability has a CVSS score of 8.8, reflecting high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Subscriber-level access to trusted users only and monitor for suspicious activity related to option changes. Consider disabling or removing the plugin if feasible. Avoid granting Subscriber or higher privileges to untrusted users.