Classified Listing – AI-Powered Classified ads & Business Directory <= 6.1.5 - Authenticated (Subscriber+) Arbitrary PHP Code Execution

The Classified Listing – AI-Powered Classified ads & Business Directory plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 6.1.5. This is due to an inverted condition in the radio/select field type validation (`!is_array` instead of `is_array`) that caused the allowlist check to be skipped for every well-formed options array, and a `wp_kses_post()` call whose return value was discarded, together allowing arbitrary values to be stored in plugin settings that are later written to static PHP configuration files. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary PHP code into plugin-generated static files, allowing execution of malicious code on the server. The attacker must have access to an AJAX settings endpoint lacking a sufficient capability check; a missing authentication guard (one of the two auth_check additions in this release) allowed Subscriber-level users to reach the settings save handler.

An attacker needs Subscriber access first, so the firewall sees the attempt as traffic from a logged-in account: WordSec's web application firewall inspects request payloads before WordPress loads them. Classes like this one can leave something behind, so the staged malware scanner is the second half: it looks for dropped files and modified code rather than for the request that created them. None of that substitutes for the fix: Classified Listing 6.2.0 closes this, and updating the plugin is the step that ends it.

• Firewall
• Scanner
• Alerts