CVE-2026-16281

7.1 highEPSS 0.3%

High (7.1). EPSS 0.3% chance of exploitation in the next 30 days.

The Classified Listing WordPress plugin before 6.1.1 does not verify that the caller owns or can edit the target listing before its AI image-editing AJAX action deletes or attaches media, allowing any authenticated user, including a subscriber, to permanently delete attachments from, and attach files to, any listing owned by another user.

Severity

CVSS 3.1

7.1 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 27% of CVEs (scores of 2026-10-31)
CWE: CWE-639
Published: 2026-09-04
Modified: 2026-09-08
Record from: the NVD, synced 2026-10-19

References

https://wpscan.com/vulnerability/e6a781c3-570f-4293-8f4c-9331389dd100/

Check your stack JSON