CyberRota Analysis
AI-GeneratedThe Classified Listing WordPress plugin prior to version 5.4.4 is vulnerable due to a lack of capability and ownership checks on an AJAX action, enabling users with contributor-level access and above to access and read any post, page, or custom post type, including drafts and private content, belonging to other users. This vulnerability poses a significant risk to user privacy and data confidentiality. WordPress site administrators and developers using this plugin should prioritize updating to the latest version to mitigate potential unauthorized content exposure.
Original NVD Description
The Classified Listing WordPress plugin before 5.4.4 does not perform a capability or ownership check on an AJAX action that returns a post's content, allowing users with contributor-level access and above to read the content of any post, page, or custom post type on the site — including drafts, pending, and private posts owned by other users — regardless of ownership.