CVE-2026-14183

The Classified Listing WordPress plugin versions before 5.3.9 is vulnerable to an Insecure Direct Object Reference (IDOR) flaw in its payment-receipt handler . The component fails to verify that the targeted order belongs to the requesting user. This allows authenticated users with subscriber-lev...