CVE-2026-78138 in Finale Lite Plugin
الملخص
بحسب MITRE • 27/08/2026
The Finale Lite WordPress plugin before 2.21.0 does not perform a capability check on an AJAX action that returns a sales-campaign's configuration for an arbitrary post ID, allowing any authenticated user (Subscriber and above) to read the Finale Lite WordPress plugin before 2.21.0's campaign configuration and scheduling data.
If you want to get best quality of vulnerability data, you may have to visit VulDB.