CVE-2026-16276CWE-862broken-access-control

CVE-2026-16276

Low · published August 3, 2026

CVSS v3.1

2.7

EPSS

Percentile

21.4

In the wild

Unconfirmed

What it is

The Classified Listing WordPress plugin before 5.4.4 does not perform a capability check on an AJAX action that returns aggregated store revenue totals, allowing users with contributor-level access and above to read daily revenue figures normally restricted to administrators and report managers.

The record

Technical detail

CVSS v3.1: 2.7 · LOW
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0: Not supplied
EPSS: 0.00299 · 21.4th percentile
Weakness: CWE-862 · Missing Authorization
Published: 2026-08-03T11:16Z

References (1)

https://wpscan.com/vulnerability/64321af7-dadb-4bde-8c8f-ca520145d02c/ · [email protected]

EPSS history

Timeline

03 AUG 06:00Z
Classified Listing < 5.4.4 - Contributor+ Store Revenue Total Disclosure via rtcl_revenue_order_search
cvelistv5