CVE-2026-78138

The Finale Lite WordPress plugin before 2.21.0 contains a missing capability check on an AJAX action that returns a sales-campaign's configuration for an arbitrary post ID. This allows any authenticated user with Subscriber privilege or above to read campaign configuration and scheduling data int...