CVE-2026-16274

CVE-2026-16274 concerns the Classified Listing WordPress plugin, versions before 5.4.4. The issue arises from a missing capability/ownership check on an AJAX action that returns a post’s content. This allows users with contributor-level access and above to read content from any post, page, or cus...