What is the CVSS score of CVE-2026-16276?

CVE-2026-16276 has a CVSS 3.1 base score of 2.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.1%.

Is there a public PoC exploit available for CVE-2026-16276?

Yes, a public proof-of-concept exploit is available for CVE-2026-16276. Prioritise patching immediately. EPSS: 0.1%.

Is there a patch available for CVE-2026-16276?

Yes, a patch is available for CVE-2026-16276. Update the affected software to the latest version immediately.

Classified Listing CVE-2026-16276

EUVD-2026-52164 LOW

Missing Authorization (CWE-862)

2026-08-03 WPScan

GHSA-jxrw-x44m-c9mq

WordPress Authentication Bypass Classified Listing Unknown

2.7

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

2.7 LOW

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Contributor is a low-privilege authenticated WordPress role (PR:L), not high; impact is read-only confidentiality exposure with no integrity or availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 04, 2026 - 18:26 vuln.today

CVSS changed

Aug 04, 2026 - 18:22 NVD

2.7 (LOW)

Patch available

Aug 03, 2026 - 07:01 EUVD

CVE Published

Aug 03, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 03, 2026 - 06:00 cve.org

LOW 2.7

DescriptionCVE.org

The Classified Listing WordPress plugin before 5.4.4 does not perform a capability check on an AJAX action that returns aggregated store revenue totals, allowing users with contributor-level access and above to read daily revenue figures normally restricted to administrators and report managers.

AnalysisAI

Unauthorized revenue data disclosure in the Classified Listing WordPress plugin (before 5.4.4) allows any authenticated contributor-level user to read daily store revenue figures restricted to administrators and report managers. The flaw stems from a missing capability check (CWE-862) on an AJAX action that aggregates store revenue totals, exposing potentially sensitive business intelligence to lower-privileged users. No public exploit identified at time of analysis per KEV, though a publicly available exploit exists per WPScan reporting; the EPSS score of 0.13% (3rd percentile) suggests limited real-world exploitation interest despite code availability.

Technical ContextAI

The Classified Listing plugin (CPE: cpe:2.3:a:unknown:classified_listing:*:*:*:*:*:*:*:*) is a WordPress marketplace/classifieds plugin. The root cause is CWE-862 (Missing Authorization): a WordPress AJAX action handler that returns aggregated store revenue totals omits a capability check, meaning WordPress's role-based access control system is not consulted before serving the response. In WordPress, AJAX actions registered with wp_ajax_{action} fire for any logged-in user unless the handler explicitly checks current_user_can() or a nonce tied to a specific role. The action was likely intended to be restricted to roles with manage_options or a custom report-manager capability, but that check was never implemented, making the handler callable by any authenticated user, including contributors.

RemediationAI

Upgrade to Classified Listing version 5.4.4 or later, which introduces the missing capability check on the affected AJAX action. The vendor-released patch is confirmed available per WPScan (https://wpscan.com/vulnerability/64321af7-dadb-4bde-8c8f-ca520145d02c/) and NVD (https://nvd.nist.gov/vuln/detail/CVE-2026-16276). If immediate upgrade is not feasible, a compensating control is to restrict the WordPress contributor role entirely from accessing the site's AJAX endpoint by blocking wp-admin/admin-ajax.php at the web server or WAF level for contributor-session cookies - note this may break other contributor-level AJAX functionality. Alternatively, disable the store revenue reporting feature within the plugin's settings if that option exists, to prevent the action from returning data even if called. The trade-off of blocking admin-ajax.php broadly is disruption to any contributor-dependent frontend features.