Description

The Finale Lite WordPress plugin before 2.21.0 does not perform a capability check on an AJAX action that returns a sales-campaign's configuration for an arbitrary post ID, allowing any authenticated user (Subscriber and above) to read the Finale Lite WordPress plugin before 2.21.0's campaign configuration and scheduling data.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-27T06:17:29.497Z",
  "pubdate": "2026-08-27T06:17:29.497Z",
  "executiveSummary": "The Finale Lite WordPress plugin is susceptible to an unauthorized information disclosure vulnerability caused by improper access control implementation.\nThe vulnerability allows any authenticated user, including those with minimal privileges such as Subscribers, to retrieve sensitive sales-campaign configurations and scheduling data for arbitrary post IDs.\nThis flaw resides in an AJAX action that lacks the necessary capability checks to restrict access based on user roles or permissions.\nThe impact includes the exposure of internal marketing strategies, campaign schedules, and potential metadata regarding site operations.\nThe vulnerability affects all versions of the Finale Lite plugin prior to 2.21.0.\nExploitation requires the attacker to be authenticated as a registered user on the WordPress installation, but it does not require administrative privileges or specific interaction from other users.\nGiven that registration is often open to the public on many WordPress instances, the risk to the confidentiality of campaign configurations is significant.",
  "technicalDetails": "The vulnerability originates from an insecure implementation of an AJAX handler within the Finale Lite plugin. Specifically, the affected code executes a database query to retrieve campaign configuration data associated with a post ID supplied via user input without verifying whether the requesting user possesses the 'manage_options' or other appropriate capabilities.\nIn WordPress development, AJAX actions are registered via the 'wp_ajax_' hook. When a developer fails to incorporate a call to current_user_can() within the callback function, the action remains accessible to any logged-in user who can send a request to the admin-ajax.php endpoint.\nThe attack flow proceeds as follows: 1) The attacker authenticates to the WordPress site as a user with subscriber-level permissions. 2) The attacker crafts an HTTP POST request targeting the admin-ajax.php endpoint. 3) The request includes the action parameter corresponding to the insecure campaign retrieval function and a post_id parameter specifying the target resource. 4) The plugin's server-side logic processes the request, retrieves the serialized or JSON-encoded campaign data from the database, and returns this information in the AJAX response.\nBecause the input validation and capability checking mechanisms are absent, the application treats the request as legitimate regardless of the user's role. The returned data may contain sensitive information, including campaign scheduling parameters, coupon configurations, and behavioral settings that were intended to be restricted to administrators or editors.\nThis vulnerability is classified as an Improper Access Control flaw. By programmatically iterating through valid post IDs, an attacker can enumerate the configuration settings for all active and scheduled campaigns on the site. The post-exploitation impact is limited to information disclosure; however, the exposure of these configurations provides an attacker with reconnaissance data that could facilitate further targeted attacks against the site's marketing infrastructure or expose business intelligence."
}