Input validation vulnerability in Classified Listing – Classified ads & Business Directory Plugin 2.4.5

The Classified Listing plugin for WordPress has a security vulnerability in versions up to and including 2.4.5. This means that attackers, who are not logged in, can delete the post thumbnail if they can get an administrator to do something like click on a link. This happens because the plugin is missing or not using the correct security measures on the ‘rtcl_ajax_thumbnail_delete’ function.