CVE-2024-3893 is a missing authorization vulnerability (CWE-862) in the Classified Listing – AI-Powered Classified ads & Business Directory Plugin for WordPress by techlabpro1. The issue arises from the lack of a capability check on the rtcl_fb_gallery_image_delete AJAX action, enabling authenticated users with subscriber-level privileges or higher to delete arbitrary attachments. This vulnerability affects all plugin versions up to and including 3.0.10.3. The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low complexity, requiring privileges, no user interaction, and resulting in integrity impact only.

An attacker with subscriber-level access or above can delete arbitrary attachments within the plugin, leading to unauthorized data modification. There is no impact on confidentiality or availability reported. This could disrupt content integrity in affected WordPress sites using the vulnerable plugin versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber-level access where possible and monitor for suspicious deletion activity related to attachments. Avoid granting unnecessary privileges to users. Follow updates from the plugin vendor for an official patch.