CVE-2026-14183 Overview
CVE-2026-14183 is an Insecure Direct Object Reference (IDOR) vulnerability [CWE-639] in the Classified Listing WordPress plugin before version 5.3.9. The plugin's payment-receipt handler fails to verify that the requested order belongs to the authenticated user. Attackers with subscriber-level access can enumerate order identifiers and read payment receipt details belonging to any other user. The flaw exposes purchase records without requiring privileged accounts, since subscriber-level accounts are trivial to obtain on sites that permit user registration.
Critical Impact
Authenticated subscriber accounts can read arbitrary users' payment receipt details, exposing transaction data and enabling reconnaissance for follow-on fraud or targeted phishing.
Affected Products
- Classified Listing WordPress plugin versions prior to 5.3.9
- WordPress sites permitting subscriber-level self-registration with the plugin installed
- Deployments exposing the plugin's payment-receipt handler to authenticated users
Discovery Timeline
- 2026-07-21 - CVE-2026-14183 published to NVD
- 2026-07-21 - Last updated in NVD database
Technical Details for CVE-2026-14183
Vulnerability Analysis
The Classified Listing plugin implements a payment-receipt handler that retrieves order data based on an order identifier passed in the request. The handler authenticates the caller but does not perform an ownership check against the order record. Any logged-in user can therefore substitute another user's order identifier and receive that order's receipt in response.
This pattern is the canonical shape of an Insecure Direct Object Reference (IDOR). Access control is enforced at the authentication layer but skipped at the object layer. Payment receipts typically contain buyer name, contact details, purchase items, amounts, and transaction metadata, all of which qualify as sensitive personal data.
Exploitation requires only a subscriber account, which is the lowest privileged role in WordPress and is often available through open registration. The scope is limited to information disclosure because the handler is read-only and does not permit modification of order state.
Root Cause
The root cause is a missing authorization check in the receipt endpoint. The code retrieves the order by its identifier without comparing the order owner to the current user identifier returned by get_current_user_id(). This is a broken access control defect categorized under [CWE-639]: Authorization Bypass Through User-Controlled Key.
Attack Vector
The attack is network-based and requires low privileges with no user interaction. An authenticated attacker submits a request to the payment-receipt endpoint while incrementing or brute-forcing the order identifier parameter. Because order identifiers are typically sequential integers, enumeration of the entire order history is straightforward. Refer to the WPScan Vulnerability Advisory for the technical breakdown of the vulnerable handler.
Detection Methods for CVE-2026-14183
Indicators of Compromise
- Sequential or high-volume requests from a single authenticated session to the plugin's payment-receipt endpoint with varying order identifier parameters
- Access log entries showing subscriber-role accounts retrieving receipts for order IDs not associated with their account
- Spikes in receipt handler responses returning HTTP 200 for accounts with no purchase history
Detection Strategies
- Correlate WordPress user session identifiers with the order owner recorded in the database for each receipt request, and alert on mismatches
- Deploy web application firewall rules that rate-limit and flag enumeration patterns against the Classified Listing receipt endpoint
- Audit plugin access logs for subscriber accounts that access receipts belonging to other user IDs
Monitoring Recommendations
- Enable verbose logging on the Classified Listing plugin and forward logs to a central analytics platform
- Monitor account creation trends for anomalous subscriber registration bursts followed by receipt endpoint traffic
- Track outbound data volumes from the receipt endpoint to detect bulk scraping of order records
How to Mitigate CVE-2026-14183
Immediate Actions Required
- Update the Classified Listing plugin to version 5.3.9 or later on all affected WordPress sites
- Review order and payment logs for unauthorized receipt access dating back to the plugin's installation
- Temporarily disable open subscriber registration if patching cannot be performed immediately
Patch Information
The vendor addressed the vulnerability in Classified Listing version 5.3.9 by adding an ownership check in the payment-receipt handler. Site administrators should update through the WordPress plugin dashboard or by replacing the plugin files manually. See the WPScan Vulnerability Advisory for the fixed version reference.
Workarounds
- Disable the Classified Listing plugin until the upgrade to 5.3.9 can be applied
- Restrict access to the payment-receipt endpoint at the web server or WAF layer to logged-in users with a specific role beyond subscriber
- Notify affected users if log review confirms unauthorized receipt access, in line with applicable data protection obligations
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
