Executive brief
The Finale Lite WordPress plugin contains an AJAX endpoint that exposes campaign configuration data without proper access controls. Any subscriber-level user can retrieve sensitive campaign settings (discount levels, inventory modes, countdown timers) for any campaign, even those they do not own or have permission to view. This allows low-privilege accounts to gather competitive or business-sensitive information that administrators intended to keep private.
Technical details
The vulnerability is an authorization bypass (CWE-200) in the wcct_quick_view_html AJAX action. The plugin fails to verify that the requesting user has capability to view a specific campaign post before returning its configuration data. An authenticated user (Subscriber and above) can craft a POST request to /wp-admin/admin-ajax.php with action=wcct_quick_view_html and an arbitrary campaign post ID, receiving HTTP 200 with the target campaign's full configuration. No nonce validation or capability check occurs. An attacker must have any authenticated account on the site and WooCommerce must be active, but can then enumerate and read any Finale campaign configuration. The plugin was patched in version 2.21.0.
Affected products
- Finale Finale Lite before 2.21.0
Timeline
- 2026-08-25: disclosed
- 2026-08-21: patched: Version 2.21.0 released