# CVE-2026-14183: RadiusTheme Classified Listing IDOR in payment-receipt handler

Source: https://junglewise.ai/threats/cve-2026-14183-radiustheme-classified-listing-idor-in-payment-receipt-handler  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-21. Updated: 2026-07-21  
License: CC BY 4.0 with a link back

CVE-2026-14183 · Severity: info · CVSS 4.3 · Published 2026-07-21

The Classified Listing plugin for WordPress, which is used to create classified advertisement websites, contains a security flaw in how it handles payment receipts. An authenticated user, such as a standard subscriber, can view the private payment details of any other user's order by guessing or knowing the order ID. This could lead to the exposure of sensitive transaction information, including plan names, pricing, and receipt URLs.

Technologies: [RadiusTheme Classified Listing](https://junglewise.ai/threats/technologies/classified-listing). Vendors: [RadiusTheme](https://junglewise.ai/threats/vendors/radiustheme).

## Quick answers

**Is CVE-2026-14183 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-14183 being exploited in the wild.

**How severe is CVE-2026-14183?** Informational severity, with a CVSS score of 4.3, published 21 July 2026.

**Which products and versions are affected?** RadiusTheme Classified Listing < 5.3.9.

**Is there a fix for CVE-2026-14183?** A patch was published on 2026-07-21: NVD publication and version 5.3.9 fix confirmed Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-14183 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-14183?** Check whether you run RadiusTheme Classified Listing at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Classified Listing plugin for WordPress is vulnerable to an Insecure Direct Object Reference (IDOR) in its payment-receipt handler. The 'rtcl_payment_details_popup' AJAX action fails to perform an ownership check on the 'order_id' parameter against the current authenticated user. An attacker with Subscriber-level permissions can obtain a valid nonce from the front-end and then send a crafted POST request to 'admin-ajax.php' to retrieve the payment details of any order. The exposed data includes the plan name, pricing options, duration, amount, currency, and the receipt URL. This issue is fixed in version 5.3.9.

## Affected products

- RadiusTheme Classified Listing < 5.3.9

## Timeline

- 2026-03-23: disclosed: Original researcher disclosure date
- 2026-06-30: advisory: WPScan advisory published
- 2026-07-21: patched: NVD publication and version 5.3.9 fix confirmed

## References

- [https://wpscan.com/vulnerability/5b720785-86a4-4610-83cb-8cc998d90ccf/](https://wpscan.com/vulnerability/5b720785-86a4-4610-83cb-8cc998d90ccf/)

## Related threats

- [RadiusTheme Classified Listing broken access control](https://junglewise.ai/threats/cve-2026-57355-radiustheme-classified-listing-broken-access-control)
- [RadiusTheme Classified Listing unauthenticated XSS](https://junglewise.ai/threats/cve-2026-57344-radiustheme-classified-listing-unauthenticated-xss)
- [RadiusTheme Classified Listing missing authorization in AJAX handler](https://junglewise.ai/threats/cve-2026-10779-radiustheme-classified-listing-missing-authorization-in-ajax)
- [Mamunur Rashid Classified Listing unauthenticated XSS](https://junglewise.ai/threats/cve-2026-42658-mamunur-rashid-classified-listing-unauthenticated-xss)
- [Mamunur Rashid Classified Listing path traversal in arbitrary file download](https://junglewise.ai/threats/cve-2026-42679-mamunur-rashid-classified-listing-path-traversal-in-arbitrary)