CVE-2026-78138: 
WordPress vulnerability analysis and mitigation

CVE-2026-78138 is an authorization bypass vulnerability (Sensitive Data Disclosure) in the Finale Lite WordPress plugin that allows any authenticated user with Subscriber-level access or higher to read sales campaign configuration and scheduling data for arbitrary post IDs. The vulnerability affects all versions of the plugin before 2.21.0 and was publicly disclosed on August 25, 2026, with NVD publication on August 27, 2026. It carries a CVSS score of 4.3 (Medium) and is classified under OWASP Top 10 A3: Sensitive Data Exposure (WPScan, Github Advisory).

The root cause is a missing capability check (CWE-200: Information Exposure) on an AJAX action handler named wcct_quick_view_html within the Finale Lite plugin. Because no authorization check is enforced before processing the AJAX request, any authenticated WordPress user can supply an arbitrary post ID and receive the associated sales campaign configuration and scheduling data in response. The vulnerability was discovered and reported by researcher Shikhali Jamalzade (Twitter: @0xAlisAlive), and a proof-of-concept is scheduled for public release on September 8, 2026, to allow time for users to update (WPScan).

Successful exploitation allows any authenticated WordPress user (Subscriber role or above) to read the Finale Lite plugin's campaign configuration and scheduling data for any post on the site. This exposes potentially sensitive business information such as discount strategies, countdown timer configurations, and promotional scheduling, which could be leveraged by competitors or malicious users to gain an unfair advantage or plan targeted attacks. The impact is limited to confidentiality — there is no evidence of integrity or availability impact (WPScan, Github Advisory).

There is currently no public proof-of-concept exploit available, and no evidence of in-the-wild exploitation has been reported. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires at minimum a Subscriber-level WordPress account, limiting the attack surface to authenticated users (WPScan, Github Advisory).

1. Obtain authentication: Register or log in to the target WordPress site with at least a Subscriber-level account.
2. Identify the vulnerable AJAX action: Locate the wcct_quick_view_html AJAX action endpoint, typically accessible via wp-admin/admin-ajax.php.
3. Craft the AJAX request: Send an authenticated HTTP POST request to wp-admin/admin-ajax.php with the parameters action=wcct_quick_view_html and a target post_id value corresponding to any post with a Finale Lite campaign configured.
4. Retrieve campaign data: The server responds with the sales campaign configuration and scheduling data for the specified post ID, including discount settings, countdown timers, and scheduling details, without performing any capability check (WPScan).

• Network: Repeated authenticated POST requests to wp-admin/admin-ajax.php with action=wcct_quick_view_html and varying post_id values from a single user account, especially a low-privilege account such as Subscriber.
• Logs: WordPress access logs showing a high volume of AJAX requests to admin-ajax.php with the wcct_quick_view_html action parameter from accounts that would not normally interact with campaign management features.
• Logs: Authentication logs showing Subscriber-level accounts making unusual numbers of requests to admin endpoints outside of normal user behavior patterns.

Update the Finale Lite WordPress plugin to version 2.21.0 or later, which introduces the required capability check on the affected AJAX action. As an interim measure, site administrators should review which users hold Subscriber-level or higher roles and consider restricting plugin access to trusted administrators only. Monitoring AJAX requests to the wcct_quick_view_html action for suspicious activity is also recommended (WPScan, Github Advisory).