Quick answers
- Is CVE-2026-14183 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-14183 being exploited in the wild.
- How severe is CVE-2026-14183?
- Informational severity, with a CVSS score of 4.3, published 21 July 2026.
- Which products and versions are affected?
- RadiusTheme Classified Listing < 5.3.9.
- Is there a fix for CVE-2026-14183?
- A patch was published on 2026-07-21: NVD publication and version 5.3.9 fix confirmed Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-14183 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-14183?
- Check whether you run RadiusTheme Classified Listing at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The Classified Listing plugin for WordPress is vulnerable to an Insecure Direct Object Reference (IDOR) in its payment-receipt handler. The 'rtcl_payment_details_popup' AJAX action fails to perform an ownership check on the 'order_id' parameter against the current authenticated user. An attacker with Subscriber-level permissions can obtain a valid nonce from the front-end and then send a crafted POST request to 'admin-ajax.php' to retrieve the payment details of any order. The exposed data includes the plan name, pricing options, duration, amount, currency, and the receipt URL. This issue is fixed in version 5.3.9.
Affected products
- RadiusTheme Classified Listing < 5.3.9
Timeline
- 2026-03-23: disclosed: Original researcher disclosure date
- 2026-06-30: advisory: WPScan advisory published
- 2026-07-21: patched: NVD publication and version 5.3.9 fix confirmed