WordPress Plugin Vulnerabilities

Finale Lite < 2.21.0 - Subscriber+ Campaign Configuration Disclosure via wcct_quick_view_html

Description

The plugin does not perform a capability check on an AJAX action that returns a sales-campaign's configuration for an arbitrary post ID, allowing any authenticated user (Subscriber and above) to read the plugin's campaign configuration and scheduling data.

Proof of Concept

Affects Plugins

Plugin icon
finale-woocommerce-sales-countdown-timer-discount
Fixed in 2.21.0

References

CVE
CVE-2026-78138

Classification

Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
A3: Sensitive Data Exposure
CWE
CWE-200
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Shikhali Jamalzade
Submitter
Shikhali Jamalzade
Submitter website
https://alisalive.medium.com
Submitter twitter
0xAlisAlive
Verified
Yes
WPVDB ID
734d6d4c-4155-4bd9-ae08-b0f34cebde2e

Timeline

Publicly Published
2026-08-25 (about 3 days ago)
Added
2026-08-25 (about 2 days ago)
Last Updated
2026-08-25 (about 2 days ago)

Other

Published
Title
Published
2025-01-24
Title
Import WP – Export and Import CSV and XML files to WordPress < 2.14.6 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory
Published
2025-01-31
Title
Directorist – AI-Powered WordPress Business Directory Plugin with Classified Ads Listings < 8.1 - Unauthenticated User Information Exposure
Published
2023-03-16
Title
WP Simple Shopping Cart 4.6.3 - Unauthenticated PII Disclosure
Published
2025-04-04
Title
Jetpack Feedback Exporter <= 1.23 - Unauthenticated Sensitive Information Exposure
Published
2025-03-13
Title
Civi <= 2.1.4 - Sensitive Information Exposure