CVE-2026-16281: CWE-639 Authorization Bypass Through User-Controlled Key in Classified Listing

The Classified Listing WordPress plugin versions before 6.1.1 contain an authorization bypass vulnerability (CWE-639) where the AI image-editing AJAX action fails to verify that the caller owns or has edit rights to the target listing. This flaw permits any authenticated user to permanently delete attachments from, or attach files to, listings owned by other users. The vulnerability affects version 5.3.0 as explicitly stated. No official patch or remediation guidance is currently provided in the available data.

Exploitation of this vulnerability allows authenticated users with minimal privileges to manipulate media attachments on listings they do not own, potentially leading to unauthorized data modification and loss of integrity of listing content. The impact is limited to integrity and availability of listing media, with no direct confidentiality impact noted.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user permissions where possible and monitor for suspicious activity related to media attachments in listings.