CVE-2026-111828— WordPress Classified Listing plugin <= 6.1.5 - Direct static code injection vulnerability
Quick assessment
Affected
Mamunur Rashid Classified Listing
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Mamunur Rashid 开发的 Classified Listing 插件存在“输入中指定数量验证不当”的漏洞，导致攻击者可访问未受访问控制列表（ACL）适当限制的功能。该问题影响 Classified Listing 插件从任意版本至 6.1.5 版本。
Possible ATT&CK Techniques 1 AI
T1548.001 · Setuid and SetgidAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Mamunur Rashid | Classified Listing | ≤ 6.1.5 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-111828
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WordPress Classified Listing plugin <= 6.1.5 - Direct static code injection vulnerability
Source: CVE Program / CVE List V5
Vulnerability Description
Improper Validation of Specified Quantity in Input vulnerability in Mamunur Rashid Classified Listing classified-listing allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Classified Listing: from n/a through 6.1.5.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
CWE-1284
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Mamunur Rashid | Classified Listing | 0 ~ 6.1.5 | - |
|
II. Public POCs for CVE-2026-111828
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-111828
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-111828 (1)
IV. Related Vulnerabilities
Same product: Classified Listing
-
CVE-2026-106646
Classified Listing < 6.1.1 - Subscriber+ Unattached Media De -
CVE-2026-94665
WordPress Classified Listing plugin <= 6.1.2 - Cross Site Sc -
CVE-2026-96351
WordPress Classified Listing plugin <= 6.1.3 - Cross Site Sc -
CVE-2026-16281
Classified Listing < 6.1.1 - Subscriber+ Arbitrary Attachmen -
CVE-2026-84217
WordPress Classified Listing plugin <= 6.1.3 - Broken Access
Same vendor: Mamunur Rashid
-
CVE-2026-94665
WordPress Classified Listing plugin <= 6.1.2 - Cross Site Sc -
CVE-2026-95596
WordPress ShopBuilder – Elementor WooCommerce Builder Addons -
CVE-2026-97280
WordPress Review Schema plugin 3.1.0 - Broken Access Control -
CVE-2026-84217
WordPress Classified Listing plugin <= 6.1.3 - Broken Access -
CVE-2026-42658
WordPress Classified Listing plugin <= 5.3.8 - Cross Site Sc
Same weakness: CWE-1284
-
CVE-2026-112112
CZ.NIC BIRD IPv6 FlowSpec 验证绕过漏洞 -
CVE-2026-103350
WordPress Booking and Rental Manager plugin <= 2.8.0 - Other -
CVE-2026-102184
Junos OS and Junos OS Evolved: A malformed EVPN SRv6 route c -
CVE-2026-102183
Junos OS and Junos OS Evolved: If in a BGP EVPN scenario a m -
CVE-2026-102033
Junos OS and Junos OS Evolved: An attacker causes denial of
V. Comments for CVE-2026-111828
No comments yet