CVE-2026-16274
Classified Listing < 5.4.4 - Contributor+ Unpublished Post Content Disclosure via rtcl_block_css_get_posts
LOW 2.7EPSS 0.3%
The Classified Listing WordPress plugin before 5.4.4 does not perform a capability or ownership check on an AJAX action that returns a post's content, allowing users with contributor-level access and above to read the content of any post, page, or custom post type on the site — including drafts, pending, and private posts owned by other users — regardless of ownership.
- Affected
- Classified Listing
- CVSS v3.1 CNA
- 2.7 LOW
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N - EPSS
- 0.30% chance of exploitation in the next 30 days, 21st percentile
- Published
- 2026-08-03
- Updated
- 2026-08-04