Security Alert Summary
The Finale Lite WordPress plugin before 2.21.0 fails to perform a capability check on an AJAX action that returns a sales-campaign configuration for an arbitrary post ID. This allows any authenticated user with a Subscriber role or higher to read campaign configuration and scheduling data for posts they might not otherwise access.
CVE Details
- CVE ID: CVE-2026-78138
- Affected component: Finale Lite WordPress plugin
- Affected versions: Versions before 2.21.0 (less than 2.21.0)
- Published date: August 27, 2026 at 6:17:29 AM
- Last modified date: August 27, 2026 at 6:17:29 AM
- CVSS v3.1: Not provided
- Authentication and privileges: Any authenticated user; specifically Subscriber and above (no elevated administrative privilege required)
- User interaction: Not required beyond being authenticated
- Primary impact:
- Confidentiality: Disclosure of campaign configuration and scheduling data
- Integrity: No integrity impact indicated in the provided data
- Availability: No availability impact indicated in the provided data
- CWE / weakness ID: Not provided
Technical Details
The plugin contains an AJAX action that returns a sales-campaign’s configuration for an arbitrary post ID. The implementation does not perform a capability check before returning that data, which means the request can be completed by any authenticated user role (Subscriber and above). Because the server-side check is missing, the vulnerability exists regardless of client-side controls.
The exposed data is campaign configuration and scheduling information for posts. The description does not name specific PHP functions, hooks, or REST API endpoints beyond indicating an AJAX action, so no additional internal function names are provided here.
Impact is limited to disclosure of the data returned by that AJAX action. The vulnerability does not, based on the provided information, indicate code execution, privilege escalation, or availability degradation.
How This Could Impact Your Website
Consider a small team managing a WordPress site: a site owner, internal content editors, and an external contractor who contributes posts. If a Subscriber-level user or another authenticated contributor can access campaign configuration and scheduling for arbitrary posts, they could learn timing and targeting details for marketing campaigns or other scheduled content.
Practical consequences include possible exposure of campaign metadata and recipient-related settings, which can increase the risk of targeted phishing or social engineering against staff or users if recipient lists or scheduling patterns are revealed. This is particularly relevant when multiple people have roles on the site, or when external contractors have authenticated accounts.
professional review If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles and accounts, especially Subscriber and Contributor roles that do not need access to campaign data.
- Enforce strong passwords and enable two-factor authentication for editor and administrator accounts.
- Remove unused or unmaintained plugins to reduce attack surface.
- Monitor site activity and logs for unusual behavior that could indicate unauthorized data access.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
