Unrated severityNVD Advisory· Published Aug 3, 2026· Updated Aug 4, 2026
Classified Listing < 5.4.4 - Contributor+ Store Revenue Total Disclosure via rtcl_revenue_order_search
CVE-2026-16276
Description
The Classified Listing WordPress plugin before 5.4.4 does not perform a capability check on an AJAX action that returns aggregated store revenue totals, allowing users with contributor-level access and above to read daily revenue figures normally restricted to administrators and report managers.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <5.4.4
Patches
Vulnerability mechanics
References
1- wpscan.com/vulnerability/64321af7-dadb-4bde-8c8f-ca520145d02c/mitreexploitvdb-entrytechnical-description
News mentions
0No linked articles in our index yet.