{"id":"CVE-2026-111828","kind":"vulnerability","aliases":["CVE-2026-111828"],"related":[],"title":"Classified Listing WordPress plugin: input validation flaw exposes restricted functionality","description":"Improper Validation of Specified Quantity in Input vulnerability in Mamunur Rashid Classified Listing classified-listing allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Classified Listing: from n/a through 6.1.5.","summary":"The Classified Listing WordPress plugin by Mamunur Rashid fails to validate a quantity input, so functionality that should be restricted by access controls can be reached. The sources describe the flaw only as accessing functionality not properly constrained by ACLs, affecting versions through 6.1.5.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["classified-listing","package","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed Classified Listing plugin version in the WordPress admin under Plugins, or with `wp plugin get classified-listing --field=version`\n- Compare the result against `6.1.5`; anything at or below that version is in the affected range","fix":"- Update Classified Listing to a version later than `6.1.5` once the vendor release is confirmed; the sources do not name the fixed version\n- If no fixed version is available, deactivate the plugin until one is released","status":"open","published_at":"2026-10-19T14:17:00+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-25T04:39:39+00:00","updated_at":"2026-10-25T04:39:39+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-10-25T04:39:39Z","model":"claude-haiku-5-5","output":{"fix":"- Update Classified Listing to a version later than `6.1.5` once the vendor release is confirmed; the sources do not name the fixed version\n- If no fixed version is available, deactivate the plugin until one is released","reach":"internet","title":"Classified Listing WordPress plugin: input validation flaw exposes restricted functionality","impact":"medium","summary":"The Classified Listing WordPress plugin by Mamunur Rashid fails to validate a quantity input, so functionality that should be restricted by access controls can be reached. The sources describe the flaw only as accessing functionality not properly constrained by ACLs, affecting versions through 6.1.5.","category":"package","nicknames":[],"who_cares":["wordpress","classified-listing"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown; sources only say access control is bypassed","analyst_note":"Find the fixed version and the vulnerable endpoint in the Wordfence or vendor advisory, since the NVD entry gives no fix version or attack details.","how_to_check":"- Check the installed Classified Listing plugin version in the WordPress admin under Plugins, or with `wp plugin get classified-listing --field=version`\n- Compare the result against `6.1.5`; anything at or below that version is in the affected range","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Classified Listing WordPress plugin at version 6.1.5 or earlier are in scope. The sources do not say which configuration or role is needed to reach the flawed functionality, so the exact exposure is unknown. Sites that do not have the plugin installed can skip this.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000638,"input_tokens":3311,"output_tokens":613,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111828':13A,16A '-2026':12A,15A '6.1.5':65B,97C 'access':43B,55B,83C 'acl':61B 'acls.this':89C 'affect':62B,91C 'allow':82C 'classifi':1A,18B,23B,77C,80C,92C 'classified-list':17B,79C 'constrain':59B,87C 'control':44B 'cve':11A,14A 'describ':50B 'expos':8A 'fail':30B 'flaw':7A,52B 'function':10A,37B,56B,84C 'improp':66C 'input':5A,35B,72C 'issu':90C 'list':2A,19B,24B,78C,81C,93C 'mamunur':28B,75C 'n/a':95C 'packag':20B 'plugin':4A,26B 'proper':58B,86C 'quantiti':34B,70C 'rashid':29B,76C 'reach':47B 'restrict':9A,41B 'sourc':49B 'specifi':69C 'valid':6A,32B,67C 'version':63B 'vulner':73C 'wordpress':3A,21B,25B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Classified Listing WordPress plugin at version 6.1.5 or earlier are in scope. The sources do not say which configuration or role is needed to reach the flawed functionality, so the exact exposure is unknown. Sites that do not have the plugin installed can skip this.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T14:17:00+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111828","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111828","severity":null,"published_at":"2026-10-19T14:17:00+00:00","modified_at":"2026-10-19T19:17:23+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}