The Classified Listing – AI-Powered Classified ads & Business Directory Plugin for WordPress (versions up to and including 5.2.0) suffers from a missing authorization check (CWE-862) in the functions rtcl_ajax_add_listing_type, rtcl_ajax_update_listing_type, and rtcl_ajax_delete_listing_type. This flaw enables authenticated users with subscriber-level privileges or above to add, update, or delete listing types without proper capability verification. The CVSS 3.1 base score is 4.3 (medium), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and no availability impact. No known exploits are reported in the wild, and no patch or vendor advisory is currently available.

The vulnerability allows unauthorized modification of listing types by authenticated users with subscriber-level access or higher. This can lead to integrity issues within the classified listings data but does not affect confidentiality or availability. There is no evidence of exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict subscriber-level access where possible and monitor for suspicious activity related to listing type modifications. Avoid granting unnecessary privileges to users. Follow vendor updates closely for an official fix.