CVE-2026-78138 Overview
CVE-2026-78138 affects the Finale Lite WordPress plugin in versions prior to 2.21.0. The plugin exposes an AJAX action that returns sales-campaign configuration data for an arbitrary post ID without performing a capability check. Any authenticated user at Subscriber level or higher can invoke the action and retrieve campaign configuration and scheduling data belonging to other posts. The issue is a broken access control flaw stemming from missing authorization on a privileged AJAX endpoint. It results in information disclosure of business-sensitive marketing data such as campaign timing, targeting parameters, and scheduling logic used by site administrators.
Critical Impact
Authenticated low-privilege users can read arbitrary Finale Lite sales-campaign configuration and scheduling data from any post ID on the site.
Affected Products
- Finale Lite WordPress plugin versions prior to 2.21.0
Discovery Timeline
- 2026-08-27 - CVE-2026-78138 published to NVD
- 2026-08-27 - Last updated in NVD database
Technical Details for CVE-2026-78138
Vulnerability Analysis
The vulnerability is a missing authorization flaw in an AJAX handler registered by the Finale Lite plugin. The endpoint accepts a post ID parameter and returns the associated sales-campaign configuration. The handler does not verify that the calling user has the capability required to read that campaign data. It also does not restrict access to administrative roles. As a result, any WordPress user session with Subscriber privileges or higher can call the endpoint and receive campaign details for any post ID on the site.
Root Cause
The root cause is a broken access control pattern common in WordPress AJAX handlers. The plugin registers its action through wp_ajax_ without pairing it with a current_user_can() capability check. Nonce verification, if present, only proves session origin and does not enforce authorization.
Attack Vector
An attacker first registers or compromises a low-privilege account on the target WordPress site. The attacker then issues a POST request to wp-admin/admin-ajax.php with the vulnerable action name and iterates through post IDs. Each response discloses the associated Finale Lite campaign configuration and scheduling metadata. See the WPScan Vulnerability Report for endpoint specifics.
Detection Methods for CVE-2026-78138
Indicators of Compromise
- Repeated POST requests to wp-admin/admin-ajax.php from Subscriber-level sessions referencing the Finale Lite campaign action.
- Sequential enumeration of the post_id parameter values by a single authenticated session within a short window.
- Unexpected outbound responses containing campaign scheduling JSON to non-administrative user sessions.
Detection Strategies
- Inspect web server access logs for authenticated users hitting admin-ajax.php with the Finale Lite action name at abnormal volumes.
- Correlate WordPress user role with AJAX action usage to identify Subscribers invoking campaign-management endpoints.
- Baseline normal AJAX traffic from marketing and administrator accounts and alert on deviations by lower-privilege roles.
Monitoring Recommendations
- Enable WordPress audit logging for all admin-ajax.php calls, including the acting user role and action parameter.
- Forward web and application logs to a centralized analytics platform for role-based query and anomaly detection.
- Alert on any Subscriber account issuing more than a small threshold of campaign-related AJAX requests per hour.
How to Mitigate CVE-2026-78138
Immediate Actions Required
- Update the Finale Lite plugin to version 2.21.0 or later on all affected WordPress installations.
- Audit existing user accounts and remove or disable unnecessary Subscriber-level registrations.
- Review recent admin-ajax.php request logs for signs of prior enumeration against Finale Lite endpoints.
Patch Information
The vendor addressed CVE-2026-78138 in Finale Lite version 2.21.0. Administrators should upgrade through the WordPress plugin manager or by replacing the plugin directory with the patched release. Refer to the WPScan Vulnerability Report for the fixed version reference.
Workarounds
- Disable open user registration in WordPress settings until the plugin is updated.
- Temporarily deactivate the Finale Lite plugin if immediate patching is not feasible.
- Restrict access to wp-admin/admin-ajax.php for authenticated non-administrative roles using a web application firewall rule scoped to the vulnerable action name.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
