What is the CVSS score of CVE-2026-16274?

CVE-2026-16274 has a CVSS 3.1 base score of 2.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.1%.

Is there a public PoC exploit available for CVE-2026-16274?

Yes, a public proof-of-concept exploit is available for CVE-2026-16274. Prioritise patching immediately. EPSS: 0.1%.

Is there a patch available for CVE-2026-16274?

Yes, a patch is available for CVE-2026-16274. Update the affected software to the latest version immediately.

Classified Listing CVE-2026-16274

EUVD-2026-52163 LOW

Missing Authorization (CWE-862)

2026-08-03 WPScan

GHSA-xw94-m5qr-wj9w

WordPress Authentication Bypass Classified Listing Unknown

2.7

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

2.7 LOW

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Contributor-level (PR:L) is sufficient per description; network AJAX vector with no complexity, confidentiality-only impact, no integrity or availability effects.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 04, 2026 - 18:27 vuln.today

CVSS changed

Aug 04, 2026 - 18:22 NVD

2.7 (LOW)

Patch available

Aug 03, 2026 - 07:01 EUVD

CVE Published

Aug 03, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 03, 2026 - 06:00 cve.org

LOW 2.7

DescriptionCVE.org

The Classified Listing WordPress plugin before 5.4.4 does not perform a capability or ownership check on an AJAX action that returns a post's content, allowing users with contributor-level access and above to read the content of any post, page, or custom post type on the site - including drafts, pending, and private posts owned by other users - regardless of ownership.

AnalysisAI

The Classified Listing WordPress plugin before version 5.4.4 exposes private, draft, and pending post content to authenticated contributors due to a missing authorization and ownership check on an AJAX endpoint. Any user with contributor-level access or higher can read arbitrary post content belonging to other users, including administrators' unpublished material. A publicly available exploit exists via WPScan, though EPSS at 0.13% (3rd percentile) and the absence of a CISA KEV listing indicate active exploitation is not confirmed at time of analysis.

Technical ContextAI

The root cause is CWE-862 (Missing Authorization): the affected AJAX action handler in the plugin fails to call WordPress capability checks such as current_user_can() and performs no post-ownership verification before returning post content to the requester. WordPress's role-and-capability system is the expected enforcement layer for post visibility (private, draft, pending); skipping it allows any authenticated user above the minimum role threshold to query arbitrary WordPress post IDs via /wp-admin/admin-ajax.php, which is accessible to all authenticated users. The CPE identifier cpe:2.3:a:unknown:classified_listing:*:*:*:*:*:*:*:* covers all versions below 5.4.4, and the vulnerability class is a classic broken access control pattern common in WordPress plugins that implement custom AJAX handlers without mirroring the access controls present in core.

RemediationAI

Upgrade the Classified Listing WordPress plugin to version 5.4.4 or later, which is confirmed to contain the authorization fix per the WPScan advisory at https://wpscan.com/vulnerability/a43925db-3108-4797-9867-0fa48cfaeab4/. If immediate patching is not feasible, the most effective compensating control is to audit and revoke contributor-level (and above) accounts belonging to untrusted or external users - eliminating untrusted contributor accounts removes the attack surface entirely without requiring any plugin changes. A secondary measure is to disable public user registration on the WordPress site (Settings > General > uncheck 'Anyone can register') or to set the default role to Subscriber rather than Contributor, preventing new registrations from reaching the required privilege threshold. Note that neither workaround patches the underlying flaw; they only reduce who can reach the vulnerable endpoint.