CVE-2026-16276 Overview
CVE-2026-16276 is a missing authorization vulnerability in the Classified Listing WordPress plugin before version 5.4.4. The plugin exposes an AJAX action that returns aggregated store revenue totals without performing a capability check. Any authenticated user with contributor-level access or higher can invoke the action and retrieve daily revenue figures normally restricted to administrators and report managers. The flaw is categorized as [CWE-862] Missing Authorization.
Critical Impact
Contributor-level accounts can read confidential store revenue data, leading to disclosure of business financial information intended only for administrators and report managers.
Affected Products
- Classified Listing WordPress plugin versions prior to 5.4.4
- WordPress installations running the vulnerable plugin with contributor or higher user roles enabled
- Multi-author WordPress sites using Classified Listing for marketplace or store functionality
Discovery Timeline
- 2026-08-03 - CVE-2026-16276 published to NVD
- 2026-08-04 - Last updated in NVD database
Technical Details for CVE-2026-16276
Vulnerability Analysis
The Classified Listing plugin registers an AJAX endpoint that returns aggregated store revenue totals. The handler executes the revenue query and returns results to the caller without verifying the user's WordPress capabilities. WordPress AJAX actions registered under wp_ajax_ are reachable by any authenticated user unless the handler explicitly enforces capability checks with functions such as current_user_can().
Because the handler omits this check, users assigned the contributor role can call the endpoint and receive daily revenue figures. Contributors are typically low-privilege users allowed only to draft posts, so exposing financial reporting data to them violates the plugin's intended access model. The vulnerability affects confidentiality only; integrity and availability of the underlying data remain intact.
Root Cause
The root cause is missing server-side authorization on a privileged AJAX action. The plugin relies on the WordPress authentication layer to gate the endpoint but does not further restrict which authenticated roles may invoke it. Report data intended for administrators and report managers is therefore returned to any logged-in user who can craft the AJAX request.
Attack Vector
Exploitation requires an authenticated session with at least contributor-level privileges. The attacker sends an HTTP POST request to the WordPress admin-ajax.php endpoint specifying the vulnerable action. The server returns aggregated daily revenue totals in the response. No user interaction beyond the attacker's own request is required. Refer to the WPScan Vulnerability Report for endpoint specifics.
Detection Methods for CVE-2026-16276
Indicators of Compromise
- Repeated POST requests to /wp-admin/admin-ajax.php from contributor or subscriber accounts referencing the Classified Listing revenue action.
- Unusual response payloads containing revenue or sales totals returned to non-administrative user sessions.
- Access log entries showing low-privilege authenticated users hitting store-reporting AJAX actions outside normal editorial workflow.
Detection Strategies
- Enable WordPress access logging and filter admin-ajax.php requests by originating user role and action name.
- Review plugin audit logs for calls to store revenue endpoints from accounts other than administrator or report manager.
- Correlate contributor-level session activity with sensitive AJAX action names to surface anomalous data access.
Monitoring Recommendations
- Alert on any non-admin account querying revenue, sales, or reporting AJAX actions on the WordPress site.
- Track the version string of the Classified Listing plugin across managed WordPress installations to identify unpatched instances.
- Baseline typical AJAX call patterns for contributor accounts and flag deviations that include reporting endpoints.
How to Mitigate CVE-2026-16276
Immediate Actions Required
- Upgrade the Classified Listing WordPress plugin to version 5.4.4 or later on all affected sites.
- Audit existing user accounts and remove or downgrade contributor-level accounts that are no longer required.
- Review recent access logs for admin-ajax.php calls to the affected revenue action from non-administrative users.
Patch Information
The vendor addressed CVE-2026-16276 in Classified Listing version 5.4.4 by adding a capability check to the affected AJAX handler. Update the plugin through the WordPress plugin management console or by replacing the plugin files with the fixed release. Details are documented in the WPScan Vulnerability Report.
Workarounds
- Temporarily restrict contributor and lower-privilege account creation on affected sites until the patch is applied.
- Use a web application firewall rule to block requests to the affected AJAX action from sessions lacking administrator capabilities.
- Disable the Classified Listing plugin on sites where store revenue reporting is not in active use until version 5.4.4 can be deployed.
# Configuration example: verify installed plugin version using WP-CLI
wp plugin get classified-listing --field=version
wp plugin update classified-listing --version=5.4.4
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
