---
id: "CVE-2026-111828"
kind: "vulnerability"
aliases: ["CVE-2026-111828"]
title: "Classified Listing WordPress plugin: input validation flaw exposes restricted functionality"
severity: "medium"
cvss: 4.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["classified-listing", "package", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-10-19T14:17:00+00:00"
first_seen_at: "2026-10-23T21:57:18+00:00"
updated_at: "2026-10-25T04:39:39+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111828", "first_seen_at": "2026-10-23T21:57:18+00:00"}]
---

# Classified Listing WordPress plugin: input validation flaw exposes restricted functionality

The Classified Listing WordPress plugin by Mamunur Rashid fails to validate a quantity input, so functionality that should be restricted by access controls can be reached. The sources describe the flaw only as accessing functionality not properly constrained by ACLs, affecting versions through 6.1.5.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Classified Listing plugin version in the WordPress admin under Plugins, or with `wp plugin get classified-listing --field=version`
- Compare the result against `6.1.5`; anything at or below that version is in the affected range

## Fix

- Update Classified Listing to a version later than `6.1.5` once the vendor release is confirmed; the sources do not name the fixed version
- If no fixed version is available, deactivate the plugin until one is released

## Timeline

- 2026-10-23T21:57:18+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111828

## From the sources

Improper Validation of Specified Quantity in Input vulnerability in Mamunur Rashid Classified Listing classified-listing allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Classified Listing: from n/a through 6.1.5.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_