Executive brief
The Classified Listing plugin for WordPress, which is used to create classified advertisement websites, contains a security flaw in how it handles payment receipts. An authenticated user, such as a standard subscriber, can view the private payment details of any other user's order by guessing or knowing the order ID. This could lead to the exposure of sensitive transaction information, including plan names, pricing, and receipt URLs.
Technical details
The Classified Listing plugin for WordPress is vulnerable to an Insecure Direct Object Reference (IDOR) in its payment-receipt handler. The 'rtcl_payment_details_popup' AJAX action fails to perform an ownership check on the 'order_id' parameter against the current authenticated user. An attacker with Subscriber-level permissions can obtain a valid nonce from the front-end and then send a crafted POST request to 'admin-ajax.php' to retrieve the payment details of any order. The exposed data includes the plan name, pricing options, duration, amount, currency, and the receipt URL. This issue is fixed in version 5.3.9.
Affected products
- RadiusTheme Classified Listing < 5.3.9
Timeline
- 2026-03-23: disclosed: Original researcher disclosure date
- 2026-06-30: advisory: WPScan advisory published
- 2026-07-21: patched: NVD publication and version 5.3.9 fix confirmed