The Classified Listing plugin for WordPress suffers from a missing capability check (CWE-862) in several functions such as export_forms(), import_forms(), and update_fb_options(). This flaw permits authenticated users with low-level privileges (subscriber and above) to perform unauthorized modifications to forms and plugin settings. The vulnerability has a CVSS 3.1 base score of 6.3, indicating a medium severity level. No known exploits are reported in the wild, and no patch or official fix has been documented yet.

An attacker with subscriber-level access can exploit this vulnerability to modify forms and various plugin settings without proper authorization. This could lead to unauthorized changes in the plugin's behavior or data, potentially affecting the integrity and availability of the classified ads and business directory functionalities. The confidentiality impact is limited but present due to unauthorized access to modify settings.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber-level access to trusted users only and monitor for suspicious activity related to form and settings modifications within the plugin.