What is the CVSS score of EUVD-2026-46162?

EUVD-2026-46162 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.1%.

Is there a public PoC exploit available for EUVD-2026-46162?

Yes, a public proof-of-concept exploit is available for EUVD-2026-46162. Prioritise patching immediately. EPSS: 0.1%.

Is there a patch available for EUVD-2026-46162?

Yes, a patch is available for EUVD-2026-46162. Update the affected software to the latest version immediately.

Classified Listing EUVD-2026-46162

| CVE-2026-14183 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-07-21 WPScan

GHSA-6phg-rm29-h3wq

WordPress Authentication Bypass Classified Listing Unknown

4.3

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network-reachable IDOR requiring only subscriber auth (PR:L); impact confined to payment receipt confidentiality (C:L); no integrity or availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 16:29 vuln.today

CVSS changed

Jul 21, 2026 - 16:22 NVD

4.3 (MEDIUM)

Patch available

Jul 21, 2026 - 08:02 EUVD

CVE Published

Jul 21, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 21, 2026 - 06:00 cve.org

MEDIUM 4.3

DescriptionCVE.org

The Classified Listing WordPress plugin before 5.3.9 does not verify that the order targeted by its payment-receipt handler belongs to the requesting user, allowing authenticated users with subscriber-level access to read the payment receipt details of any other user's order.

AnalysisAI

Insecure Direct Object Reference (IDOR) in the Classified Listing WordPress plugin before 5.3.9 exposes payment receipt data across arbitrary user accounts. Any authenticated user holding subscriber-level access - the default role assigned upon registration on most WordPress sites - can query the payment-receipt handler with any order ID and receive full receipt details belonging to another user, because no ownership check is performed. A publicly available exploit exists per WPScan, and a vendor-released patch at version 5.3.9 is available; no KEV listing is present at time of analysis.

Technical ContextAI

The Classified Listing plugin (CPE: cpe:2.3:a:unknown:classified_listing:*:*:*:*:*:*:*:*) is a WordPress classified-ads and listing management plugin that includes an e-commerce payment flow generating order receipts. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key): the payment-receipt handler accepts an order identifier supplied by the requesting user but performs no server-side check to confirm that the authenticated session owns the referenced order. This is a classic IDOR pattern - the object key (order ID) is the only access control, and because it is user-controlled and predictable (typically sequential integers in WooCommerce-adjacent systems), enumeration is trivial. The WordPress subscriber role is granted by default to any self-registered user, meaning the attack surface extends to any site with open registration or any attacker who can create an account.

RemediationAI

Update the Classified Listing WordPress plugin to version 5.3.9 or later, which introduces server-side ownership validation on the payment-receipt handler. The vendor-released patch is the only confirmed fix; apply it via the WordPress admin dashboard under Plugins > Updates or by downloading directly from the WordPress plugin repository. If immediate patching is not feasible, the most actionable compensating control is to disable open user registration (Settings > General > uncheck 'Anyone can register') so that subscriber accounts cannot be created by unauthenticated outsiders - this does not eliminate risk from existing subscriber accounts but eliminates the easiest onboarding path for an attacker. A second compensating control is to restrict access to the payment-receipt endpoint via WAF rules or server-level ACLs, though the specific endpoint path should be confirmed from plugin source before implementing, as misconfigured blocks may break legitimate order confirmations. Neither workaround replaces the patch. Advisory references: https://wpscan.com/vulnerability/5b720785-86a4-4610-83cb-8cc998d90ccf/ and https://nvd.nist.gov/vuln/detail/CVE-2026-14183.