PT-2026-67103

CVE-2026-16274

Published

2026-07-23

Updated

2026-08-04

Description by

CVSS 3.1

2.7

Low

MetricsAV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Classified Listing WordPress plugin versions prior to 5.4.4

Description An AJAX action that returns post content fails to perform necessary capability or ownership checks. This allows users with contributor-level access or higher to read the content of any post, page, or custom post type on the site, including private, pending, and draft content owned by other users.

Recommendations Update the Classified Listing WordPress plugin to version 5.4.4 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Huseyin Mertoglu

Vendors

Affected products

Weakness enumeration

CWE-862: Missing Authorization

Related identifiers