CVE-2026-16274
LowCVSS 2.7Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
The 'Classified Listing' WordPress plugin before version 5.4.4 does not perform a capability or ownership check on an AJAX action that returns a post's content, allowing users with contributor-level access and above to read the content of any post, page, or custom post type on the site — including drafts, pending, and private posts owned by other users — regardless of ownership.
Risk Assessment
Lower-privileged users can access sensitive content, including unpublished posts and private data of other users.
Recommendation
Update the plugin to version 5.4.4 or later, which adds proper capability and ownership checks.
Original NVD description (English source)
The Classified Listing WordPress plugin before 5.4.4 does not perform a capability or ownership check on an AJAX action that returns a post's content, allowing users with contributor-level access and above to read the content of any post, page, or custom post type on the site — including drafts, pending, and private posts owned by other users — regardless of ownership.