Vulnerabilities CVE-2026-16274

CVE-2026-16274

None

Open

TLP:CLEAR

Classified Listing < 5.4.4 - Contributor+ Unpublished Post Content Disclosure via rtcl_block_css_get_posts

NVD CVE.org

AI Analysis

No AI analysis yet.

Description

The Classified Listing WordPress plugin before 5.4.4 does not perform a capability or ownership check on an AJAX action that returns a post's content, allowing users with contributor-level access and above to read the content of any post, page, or custom post type on the site — including drafts, pending, and private posts owned by other users — regardless of ownership.

Details

EPSS Score ⓘ: 0.18%

7.6th percentile
Confidence: 90%
Published: Aug 3, 2026
Last Modified: Aug 4, 2026

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.