SEPTEMBER 7, 2026
Live Feed
Back to database
Case File

CVE-2026-14183

MEDIUM · CVSS 4.3 EPSS 0.16%

Source: NVD + CISA KEV + EPSS · Published 2026-07-21 · Last synced 2026-08-20

CyberRota Analysis

AI-Generated

The Classified Listing WordPress plugin prior to version 5.3.9 is vulnerable as it fails to properly verify user permissions for accessing payment receipt details, allowing authenticated users with subscriber-level access to view other users' order information. This could lead to unauthorized disclosure of sensitive payment data. WordPress site administrators using this plugin should prioritize updating to the latest version to mitigate potential privacy breaches.

CVE
CVE-2026-14183
Severity
MEDIUM
CVSS
4.3
EPSS
0.16%
WordPress

Original NVD Description

The Classified Listing WordPress plugin before 5.3.9 does not verify that the order targeted by its payment-receipt handler belongs to the requesting user, allowing authenticated users with subscriber-level access to read the payment receipt details of any other user's order.