What the vulnerability does
01Description
The Classified Pro theme for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check in the 'cwp_addons_update_plugin_cb' function in all versions up to, and including, 1.0.14. This makes it possible for authenticated attackers, with subscriber-level access and above, to install arbitrary plugins on the affected site's server which may make remote code execution possible. Note: The required nonce for the vulnerability is in the CubeWP Framework plugin.
Explanation of Vulnerability in Simple Terms
02Summary
ClassifiedPro theme versions up to 1.0.14 lack proper authorization checks, allowing authenticated users with low privileges to read, modify, or delete data they should not access. An attacker with a basic user account can perform administrative actions without restriction. Update to a version newer than 1.0.14 immediately.
What an attacker can do
03Attacker Capabilities
Read, modify, or delete site data and settings with a low-privilege user account.
Potential impact on your site
04Site Impact
Any registered user can access and alter sensitive site data, user accounts, and configuration.
Conditions required to exploit
05Prerequisites
Attacker needs a valid low-privilege user account on the site; no special interaction required.
Key dates
06Disclosure timeline
October 16, 2025
CVE published
April 8, 2026
Record updated
