CVE-2026-10779: Classified Listing WordPress Plugin Authorization Bypass

Technical summary

The vulnerability exists in the rtcl_fb_gallery_image_update_as_feature AJAX handler, which processes requests to set a listing's featured image. The handler accepts user-supplied listing ID and attachment ID parameters but only validates a WordPress nonce token—a security measure intended to prevent cross-site request forgery. Because the nonce is embedded in the frontend listing-submission form and visible to any authenticated user, nonce validation alone does not confirm the user has permission to modify a specific listing. The missing authorization check (CWE-862) means any authenticated user can target and modify listings owned by other users.

Business impact

For WordPress sites running classified ad platforms, this vulnerability enables account holders to sabotage competitors' listings or manipulate marketplace presentation. A malicious subscriber could replace legitimate product images with inappropriate content, damaging merchant trust and customer experience. Site operators face potential liability for defaced listings, platform credibility erosion, and reputational harm. The impact scales with the number of active marketplace users and the value of listings exposed.

Affected systems

The Classified Listing – Classified ads & Business Directory plugin is affected in all versions up to and including 5.4.2. Any WordPress installation running this plugin with the vulnerable code version and with one or more subscribers or higher-privilege users is at risk. The attack requires no special network conditions and can be executed remotely over HTTP(S).

Exploitability

Exploitation is straightforward and requires only basic access: an attacker needs a WordPress account with Subscriber-level permissions or above (the default for any registered user on many sites) and knowledge of a target listing ID. The AJAX endpoint is not hidden and nonce tokens are reused across requests, making reconnaissance trivial. No user interaction, special tools, or social engineering is required; the attacker can directly submit crafted AJAX requests.

Remediation

Patch immediately to a version that includes authorization checks. Verify with the plugin vendor or your security advisory feed for the earliest patched release after 5.4.2. In the interim, restrict Subscriber-level access to your WordPress site if the plugin is active, or disable the plugin until a patch is confirmed. Monitor your listings for unauthorized image changes and audit user activity logs for suspicious AJAX calls to rtcl_fb_gallery_image_update_as_feature.

Patch guidance

Visit the Classified Listing plugin's official WordPress.org page or vendor support channel to identify and deploy the patched version. Once available, apply the patch immediately through your WordPress admin dashboard or CLI. Before patching, take a backup of your database and plugin directory. After patching, verify that the authorization check is in place and test that non-owner accounts can no longer modify listings belonging to others.

Detection guidance

Search WordPress database and server logs for POST requests to wp-admin/admin-ajax.php with action=rtcl_fb_gallery_image_update_as_feature paired with listing IDs that do not belong to the requesting user. Monitor for rapid or repeated calls to this endpoint from a single user or IP. Audit the wp_postmeta table for unscheduled changes to listing meta fields related to featured images. Review user activity logs and nonce usage patterns to identify potential attacks.

Why prioritize this

Although the CVSS score of 4.3 (Medium) reflects limited scope and no confidentiality impact, the ease of exploitation and the marketplace-disruption risk make this a clear priority for sites running classified ad plugins. Any platform managing user-generated marketplace content should treat unauthorized modification vulnerabilities as high-priority due to trust and business continuity concerns. Attackers require only subscriber access, which is trivial to obtain on open platforms.

Risk score, explained

The CVSS:3.1 score of 4.3 reflects a network-accessible vulnerability requiring low privileges and no user interaction, but with only integrity impact (unauthorized image changes) and no confidentiality or availability impact. The Medium severity label accurately captures the real-world risk for marketplace platforms, where data integrity and user trust are critical even without system outage or data exposure.

Frequently asked questions