CVE-2026-78138 — Finale Lite < 2.21.0 - Subscriber+ Campaign Configuration Disclosure via wcct_quick_view_html

CVE-2026-78138

Finale Lite < 2.21.0 - Subscriber+ Campaign Configuration Disclosure via wcct_quick_view_html PUBLISHED

Description (CNA)

The Finale Lite WordPress plugin before 2.21.0 does not perform a capability check on an AJAX action that returns a sales-campaign's configuration for an arbitrary post ID, allowing any authenticated user (Subscriber and above) to read the Finale Lite WordPress plugin before 2.21.0's campaign configuration and scheduling data.

Affected (CNA)

Vendor / product	Versions
Unknown / Finale Lite	affected 0 before 2.21.0

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/734d6d4c-4155-4bd9-ae08-b0f34cebde2e/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.