CVE-2026-16276
LowCVSS 2.7Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
The 'Classified Listing' WordPress plugin before version 5.4.4 does not perform a capability check on an AJAX action that returns aggregated store revenue totals, allowing users with contributor-level access and above to read daily revenue figures normally restricted to administrators and report managers.
Risk Assessment
Lower-privileged users can access sensitive financial data, potentially leading to business information leakage.
Recommendation
Update the plugin to version 5.4.4 or later, which adds proper capability checks.
Original NVD description (English source)
The Classified Listing WordPress plugin before 5.4.4 does not perform a capability check on an AJAX action that returns aggregated store revenue totals, allowing users with contributor-level access and above to read daily revenue figures normally restricted to administrators and report managers.