CVE-2026-16274 Overview
CVE-2026-16274 is a missing authorization vulnerability [CWE-862] in the Classified Listing WordPress plugin before version 5.4.4. The plugin exposes an AJAX action that returns post content without performing capability or ownership checks. Any authenticated user with contributor-level access or higher can read the content of any post, page, or custom post type on the site. This includes drafts, pending, and private posts owned by other users. The flaw enables horizontal information disclosure across user boundaries within affected WordPress installations.
Critical Impact
Authenticated low-privilege users can read arbitrary draft, pending, and private post content owned by other users, bypassing WordPress ownership and visibility controls.
Affected Products
- Classified Listing WordPress plugin versions before 5.4.4
- WordPress installations with the plugin installed and contributor-or-higher accounts provisioned
- Multi-author WordPress sites relying on private or draft post confidentiality
Discovery Timeline
- 2026-08-03 - CVE-2026-16274 published to NVD
- 2026-08-04 - Last updated in NVD database
Technical Details for CVE-2026-16274
Vulnerability Analysis
The Classified Listing plugin registers an AJAX handler that returns the raw content of a post identified by an attacker-supplied identifier. The handler validates that the requester is authenticated but omits a current_user_can() capability check and does not verify post ownership. As a result, the endpoint returns content for any post ID, regardless of post status or author.
WordPress normally restricts unpublished content to the author and privileged roles such as editors and administrators. Contributors can create drafts but should not read drafts authored by others. This plugin bypasses that model by exposing post content directly through the AJAX interface. The impact is limited to confidentiality; integrity and availability are unaffected.
Root Cause
The root cause is missing authorization on a privileged AJAX action [CWE-862]. The handler trusts the authenticated session without confirming the user has permission to view the requested post. The vulnerability class corresponds to broken access control on server-side request handlers.
Attack Vector
Exploitation requires network access to the WordPress site and an authenticated account with contributor privileges or higher. An attacker submits a crafted AJAX request referencing a target post identifier. The server responds with the post content, including drafts, pending submissions, and private posts written by other users. No user interaction or additional privileges are needed beyond the initial authenticated session.
See the WPScan Vulnerability Advisory for the technical write-up.
Detection Methods for CVE-2026-16274
Indicators of Compromise
- Repeated AJAX POST requests from contributor-level accounts to admin-ajax.php referencing the Classified Listing plugin action name and iterating post IDs.
- Access log entries showing contributor accounts retrieving content associated with post IDs they do not own.
- Unusual enumeration patterns where a single authenticated session queries sequential or bulk post identifiers.
Detection Strategies
- Review WordPress access logs for high-volume admin-ajax.php requests originating from contributor or author accounts.
- Correlate AJAX requests with WordPress post ownership metadata to identify cross-user reads.
- Enable WordPress audit logging plugins to capture AJAX action invocations and requester identity.
Monitoring Recommendations
- Monitor the Classified Listing plugin version deployed across managed WordPress sites and flag installations below 5.4.4.
- Alert on newly created contributor accounts followed by bursts of AJAX activity within short time windows.
- Track outbound data volumes from admin-ajax.php responses to identify content exfiltration patterns.
How to Mitigate CVE-2026-16274
Immediate Actions Required
- Update the Classified Listing WordPress plugin to version 5.4.4 or later on all affected sites.
- Audit contributor, author, and editor accounts and disable or reset credentials for any that appear inactive or suspicious.
- Review draft, pending, and private posts for sensitive content that may have been disclosed.
Patch Information
Upgrade to Classified Listing version 5.4.4, which adds the missing capability and ownership checks to the affected AJAX action. Refer to the WPScan Vulnerability Advisory for advisory details and fixed version information.
Workarounds
- Temporarily deactivate the Classified Listing plugin until the patched version is deployed.
- Restrict contributor-level and higher account creation until remediation is complete.
- Use a Web Application Firewall rule to block requests to the vulnerable AJAX action from non-privileged sessions.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
