CVE-2026-10779 is a missing authorization vulnerability (CWE-862) in the Classified Listing – AI-Powered Classified ads & Business Directory WordPress plugin by techlabpro1. The issue exists in the AJAX handler rtcl_fb_gallery_image_update_as_feature, which accepts user-supplied listing and attachment IDs to set a listing's featured image. The handler validates only a nonce exposed to all logged-in users but does not verify if the user owns the listing or has the capability to modify it. This allows authenticated users with Subscriber-level privileges or higher to arbitrarily change the featured images of listings they do not own. The vulnerability affects all plugin versions up to and including 5.4.2. No official patch or remediation guidance has been published yet.

An authenticated attacker with Subscriber-level access or higher can modify the featured image of any listing, including those they do not own. This unauthorized modification can lead to misinformation or misrepresentation of listings on the site. There is no direct confidentiality or availability impact reported. The CVSS v3.1 base score is 4.3 (medium severity), reflecting low complexity and limited privileges required but limited impact scope.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict user roles and capabilities to trusted users only and monitor for unauthorized changes to listings. Avoid granting Subscriber-level or higher access to untrusted users. Implement additional custom authorization checks if possible to verify listing ownership before allowing featured image updates.