CVE-2026-78138 in Finale Lite Plugin
Summary
by MITRE • 08/27/2026
The Finale Lite WordPress plugin before 2.21.0 does not perform a capability check on an AJAX action that returns a sales-campaign's configuration for an arbitrary post ID, allowing any authenticated user (Subscriber and above) to read the Finale Lite WordPress plugin before 2.21.0's campaign configuration and scheduling data.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/27/2026
The vulnerability identified in Finale Lite versions prior to 2.21.0 represents a critical failure in access control mechanisms within the WordPress ecosystem, specifically affecting authenticated users with subscriber-level privileges or higher. This flaw stems from an improper implementation of capability checks on specific AJAX endpoints exposed by the plugin. In secure web application design, any action that modifies state or retrieves sensitive data must verify that the requesting user possesses the necessary permissions to perform that operation. However, in this instance, the endpoint responsible for returning a sales campaign's configuration does not validate whether the authenticated user is authorized to view such information based on their role or specific capabilities assigned by the site administrator.
From a technical perspective, the vulnerability allows an attacker with even minimal access rights, such as those granted to subscribers who typically have limited interaction permissions like commenting or viewing content, to exploit this misconfiguration. By crafting a malicious AJAX request targeting the vulnerable endpoint and supplying an arbitrary post ID associated with a sales campaign, the attacker can retrieve detailed configuration data. This includes sensitive scheduling information and internal settings that define how marketing campaigns are executed. The lack of object-level authorization checks means that the system trusts the input provided by the user without verifying if that user owns or is permitted to access the specific resource identified by the post ID.
The operational impact of this vulnerability extends beyond simple data leakage, as it facilitates broader security risks within a WordPress installation. Access to campaign configurations can reveal strategic business information, including pricing structures, promotional timelines, and target audience parameters. Furthermore, in many plugin architectures, configuration data may contain API keys, webhook URLs, or other integration details that could be leveraged for further attacks. This scenario aligns with CWE-284, which describes Improper Access Control, where the application fails to restrict access to resources based on user privileges. It also maps directly to MITRE ATT&CK technique T1078, specifically Valid Accounts, as it relies on legitimate credentials that are insufficiently restricted by the application logic rather than being stolen through external means.
Mitigation for this vulnerability requires immediate action from site administrators and plugin developers. The primary remediation is to upgrade Finale Lite to version 2.21.0 or later, where these capability checks have been properly implemented to ensure that only users with appropriate administrative or editor-level permissions can access campaign configuration data. For organizations unable to update immediately due to compatibility constraints, temporary mitigations include restricting user roles on the WordPress site to minimize the number of authenticated accounts with subscriber privileges and above, thereby reducing the attack surface. Additionally, implementing a Web Application Firewall (WAF) rule that monitors for anomalous AJAX requests targeting plugin endpoints can provide an additional layer of defense by blocking unauthorized access attempts until the software is patched.