[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f9Z-Gzy6eSaJhqo1I6FbSk8Mgwla-UzcGCC5ZU9pgXnU":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":32,"research_plan":33,"research_summary":9,"research_vulnerable_code":9,"research_fix_diff":9,"research_exploit_outline":9,"research_model_used":34,"research_started_at":35,"research_completed_at":36,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":37},"CVE-2026-57355","classified-listing-ai-powered-classified-ads-business-directory-missing-authorization","Classified Listing – AI-Powered Classified ads & Business Directory \u003C= 5.4.2 - Missing Authorization","The Classified Listing – AI-Powered Classified ads & Business Directory plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 5.4.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action.","classified-listing",null,"\u003C=5.4.2","5.4.3","medium",4.3,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:L\u002FA:N","Missing Authorization","2026-07-01 00:00:00","2026-07-07 20:01:02",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Ff2fb18eb-a5ce-463f-aae2-55dc0bb3e9c7?source=api-prod",7,[22,23,24,25,26,27,28,29],"README.txt","app\u002FControllers\u002FAdmin\u002FNoticeController.php","app\u002FControllers\u002FAdmin\u002FScriptLoader.php","app\u002FControllers\u002FAjax\u002FFilterAjax.php","app\u002FControllers\u002FAjax\u002FFormBuilderAjax.php","app\u002FControllers\u002FAjax\u002FPublicUser.php","assets\u002Fblock\u002Fmain.asset.php","assets\u002Fblock\u002Fmain.js","researched",false,3,"# Exploitation Research Plan - CVE-2026-57355\n\n## 1. Vulnerability Summary\nThe **Classified Listing – AI-Powered Classified ads & Business Directory** plugin (up to 5.4.2) is vulnerable to **Missing Authorization** in its administrative notice handling logic. Specifically, the `Rtcl\\Controllers\\Admin\\NoticeController` class hooks the `update_rating_status` function to `admin_init`. Because `admin_init` fires for every user accessing the WordPress dashboard (including low-privileged Subscribers), and because this function likely lacks a `current_user_can('manage_options')` check, authenticated attackers can perform unauthorized actions such as dismissing site-wide plugin notices or modifying plugin-wide \"rating\" metadata.\n\n## 2. Attack Vector Analysis\n- **Endpoint:** `\u002Fwp-admin\u002Findex.php` (or any admin-area URL that triggers `admin_init`).\n- **HTTP Method:** `GET`\n- **Action Hook:** `admin_init` calls `Rtcl\\Controllers\\Admin\\NoticeController::update_rating_status`.\n- **Payload Parameters:**\n    - `rtcl_skip`: Set to `1` to trigger notice dismissal.\n    - `rtcl_reminder`: Set to `1` to delay the notice.\n    - `rtcl_rated`: Set to `1` to mark the plugin as rated.\n    - `_wpnonce`: A required nonce with the action string `rtcl_notice_nonce`.\n- **Authentication:** Required (Subscriber or higher).\n- **Preconditions:** The \"Enjoying Classified Listing?\" rating notice must be active or eligible to be displayed (triggered by the plugin being active for a certain duration).\n\n## 3. Code Flow\n1. **Entry Point:** A Subscriber logs into the WordPress dashboard (`\u002Fwp-admin\u002F`).\n2. **Hook Execution:** `wp-admin\u002Fadmin.php` (and others) trigger `admin_init`.\n3. **Vulnerable Handler:** `Rtcl\\Controllers\\Admin\\NoticeController::__construct` registers `update_rating_status` to `admin_init`.\n4. **Missing Check:** `update_rating_status` (inferred) processes `$_GET['rtcl_skip']` and verifies the nonce `$_GET['_wpnonce']` using the action `rtcl_notice_nonce`.\n5. **Unauthorized Action:** If the nonce is valid, the function proceeds to `update_option()` to dismiss the notice for the entire site, despite the user only having Subscriber permissions.\n\n## 4. Nonce Acquisition Strategy\nThe nonce `rtcl_notice_nonce` is generated within the `display_admin_notice()` method of `NoticeController.php`. This notice is hooked to `admin_notices`, which is visible to Subscribers on their dashboard.\n\n**Steps to obtain the nonce:**\n1. Log in as a **Subscriber**.\n2. Navigate to `\u002Fwp-admin\u002Findex.php`.\n3. Locate the rating notice in the HTML (class `.rtcl-review-notice`).\n4. Extract the `_wpnonce` value from the \"No Thanks\" or \"Already Rated!\" links.\n\n**Automated Extraction (browser_eval):**\n```javascript\n\u002F\u002F Locate the 'No Thanks' link which contains the dismissal parameters and nonce\nconst dismissalLink = document.querySelector('.rtcl-review-notice a[href*=\"rtcl_skip=1\"]')?.href;\nif (dismissalLink) {\n    const urlParams = new URLSearchParams(new URL(dismissalLink).search);\n    console.log(urlParams.get('_wpnonce'));\n}\n```\n\n## 5. Exploitation Strategy\n### Step 1: Triggering the Site-Wide Dismissal\nOnce the nonce is acquired, the Subscriber sends a request to trigger the dismissal for all users.\n\n- **Tool:** `http_request`\n- **Method:** `GET`\n- **URL:** `http:\u002F\u002Fvulnerable-site.com\u002Fwp-admin\u002Findex.php?rtcl_skip=1&_wpnonce=[EXTRACTED_NONCE]`\n- **Headers:** \n    - `Cookie`: [Subscriber Session Cookies]\n\n### Step 2: Verification\nAs an **Administrator**, navigate to the dashboard. The rating notice, which should have been visible, will now be gone site-wide because the plugin option (e.g., `rtcl_rating_notice_dismissed`) has been updated.\n\n## 6. Test Data Setup\n","gemini-3-flash-preview","2026-07-25 12:24:48","2026-07-25 12:26:15",{"type":38,"vulnerable_version":39,"fixed_version":11,"vulnerable_browse":40,"vulnerable_zip":41,"fixed_browse":42,"fixed_zip":43,"all_tags":44},"plugin","5.4.2","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fclassified-listing\u002Ftags\u002F5.4.2","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fclassified-listing.5.4.2.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fclassified-listing\u002Ftags\u002F5.4.3","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fclassified-listing.5.4.3.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fclassified-listing\u002Ftags"]