What is GHSA-p9w8-7wph-h4x9?

GHSA-p9w8-7wph-h4x9 is a security advisory published by GitHub Security Advisories with High severity. The Classified Listing WordPress plugin before 6.1.1 does not verify that the caller owns or can...

Which CVE IDs does GHSA-p9w8-7wph-h4x9 cover?

GHSA-p9w8-7wph-h4x9 covers the following CVE IDs: CVE-2026-16281. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-p9w8-7wph-h4x9?

GHSA-p9w8-7wph-h4x9 has a CVSS v3 base score of 7.1, published by GitHub Security Advisories.

GHSA-p9w8-7wph-h4x9HighCVSS 7.1

The Classified Listing WordPress plugin before 6.1.1 does not verify that the caller owns or can...

Vendor

GitHub Security Advisories

Published

September 4, 2026

Last Modified

September 4, 2026

🔗 CVE IDs covered (1)

CVE-2026-16281 →

📋 Description

The Classified Listing WordPress plugin before 6.1.1 does not verify that the caller owns or can edit the target listing before its AI image-editing AJAX action deletes or attaches media, allowing any authenticated user, including a subscriber, to permanently delete attachments from, and attach files to, any listing owned by another user.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-16281
https://wpscan.com/vulnerability/e6a781c3-570f-4293-8f4c-9331389dd100
https://github.com/advisories/GHSA-p9w8-7wph-h4x9