CVE-2026-14183 in Classified Listing Plugin
Summary
by MITRE • 07/21/2026
The Classified Listing WordPress plugin before 5.3.9 does not verify that the order targeted by its payment-receipt handler belongs to the requesting user, allowing authenticated users with subscriber-level access to read the payment receipt details of any other user's order.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/21/2026
The vulnerability exists within the Classified Listing WordPress plugin version 5.3.8 and earlier, where insufficient access control mechanisms fail to validate user ownership of orders during payment receipt processing. This authentication bypass flaw allows low-privilege subscribers to exploit the payment-receipt handler endpoint and retrieve sensitive financial information belonging to other users. The issue stems from a missing authorization check that should verify whether the requesting user has legitimate access rights to view specific order details before serving the payment receipt data.
The technical implementation of this vulnerability demonstrates a classic access control weakness where the plugin's payment-receipt handler lacks proper user context validation. When an authenticated subscriber makes a request to the payment-receipt endpoint, the system fails to cross-reference the requested order ID against the current user's order history or ownership permissions. This creates a scenario where any authenticated user can manipulate the order identifier parameter to access another user's payment information, effectively bypassing the intended access controls that should restrict such data exposure to authorized parties only.
The operational impact of this vulnerability extends beyond simple privacy concerns as it provides attackers with detailed financial transaction data including payment amounts, transaction identifiers, and potentially customer billing information. This exposure could enable malicious subscribers to engage in account takeover activities, financial fraud, or data exfiltration attempts that compromise both user privacy and business integrity. The vulnerability is particularly concerning because it operates at the application level without requiring elevated privileges beyond standard subscriber access, making it accessible to anyone with a valid user account.
Security practitioners should implement immediate mitigations including updating to Classified Listing plugin version 5.3.9 or later, which contains the necessary authorization checks. Additionally, administrators should review and tighten user role permissions, ensuring that only authorized personnel have access to payment processing functions. The vulnerability aligns with CWE-285, which addresses improper authorization in software applications, and could be categorized under ATT&CK technique T1078 for valid accounts and T1566 for credential harvesting through application exploitation. Organizations should also consider implementing additional logging mechanisms to detect unauthorized access attempts to payment-related endpoints, enabling better monitoring of potential exploitation activities.