{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-16274", "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "state": "PUBLISHED", "assignerShortName": "WPScan", "dateReserved": "2026-07-20T10:04:01.162Z", "datePublished": "2026-08-03T06:00:10.403Z", "dateUpdated": "2026-08-03T06:00:10.403Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan", "dateUpdated": "2026-08-03T06:00:10.403Z"}, "title": "Classified Listing < 5.4.4 - Contributor+ Unpublished Post Content Disclosure via rtcl_block_css_get_posts", "problemTypes": [{"descriptions": [{"description": "CWE-862 Missing Authorization", "lang": "en", "type": "CWE"}]}], "affected": [{"vendor": "Unknown", "product": "Classified Listing", "versions": [{"status": "affected", "versionType": "semver", "version": "0", "lessThan": "5.4.4"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Classified Listing WordPress plugin before 5.4.4 does not perform a capability or ownership check on an AJAX action that returns a post's content, allowing users with contributor-level access and above to read the content of any post, page, or custom post type on the site \u2014 including drafts, pending, and private posts owned by other users \u2014 regardless of ownership."}], "references": [{"url": "https://wpscan.com/vulnerability/a43925db-3108-4797-9867-0fa48cfaeab4/", "tags": ["exploit", "vdb-entry", "technical-description"]}], "credits": [{"lang": "en", "value": "Huseyin Mertoglu", "type": "finder"}, {"lang": "en", "value": "WPScan", "type": "coordinator"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "WPScan CVE Generator"}}}}

{}

{}

{}