CVE-2026-7563 is a missing authorization vulnerability (CWE-862) in the Classified Listing – AI-Powered Classified ads & Business Directory Plugin for WordPress. The plugin fails to properly verify user permissions before allowing certain actions, permitting authenticated users with subscriber-level privileges or higher to add arbitrary notes to orders. This unauthorized action also triggers unsolicited notification and moderation emails to listing owners. The vulnerability affects all versions up to and including 5.3.10. The CVSS 3.1 base score is 4.3 (medium severity), reflecting network attack vector, low complexity, low privileges required, no user interaction, unchanged scope, no confidentiality or availability impact, and limited integrity impact. No patch or official remediation is currently documented.

The vulnerability allows authenticated users with subscriber-level access or higher to modify order data by adding arbitrary notes without proper authorization. This can lead to unsolicited notification and moderation emails being sent to listing owners, potentially causing confusion or administrative overhead. There is no impact on confidentiality or availability. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber-level access where possible and monitor for unusual notification activity. Avoid granting unnecessary privileges to users. Follow vendor channels for updates on patches or official mitigations.