Medium · 6.5 CVE-2026-42679 EUVD-2026-33683GHSA-8pf8-7vpw-x352

WordPress Classified Listing plugin <= 5.3.8 - Arbitrary File Download vulnerability

Published Jun 1, 2026 · Updated Jun 1, 2026 · Assigned by Patchstack

Vendor: Mamunur Rashid Product: Classified Listing

Description

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Mamunur Rashid Classified Listing allows Path Traversal.

This issue affects Classified Listing: from n/a through 5.3.8.

Affected products

Vendor	Product	Affected	Fixed
Mamunur Rashid	Classified Listing	≤ 5.3.8	—

References

https://patchstack.com/database/wordpress/plugin/classified-listing/vulnerability/wordpress-classified-listing-plugin-5-3-8-arbitrary-file-download-vulnerability?_s_id=cve vdb-entry