CVE-2026-14183 is an authorization bypass vulnerability (CWE-639) in the Classified Listing WordPress plugin prior to version 5.3.9. The vulnerability occurs because the plugin's payment-receipt handler fails to confirm that the order being accessed belongs to the requesting user. As a result, any authenticated subscriber-level user can read payment receipt details of other users' orders, potentially exposing sensitive information.

Authenticated users with subscriber-level privileges can access payment receipt details of other users' orders, leading to unauthorized disclosure of potentially sensitive payment information. There is no indication of remote code execution or privilege escalation beyond information disclosure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions before 5.3.9, upgrading to version 5.3.9 or later (once confirmed) is recommended. Until an official fix is available, restrict subscriber-level access or monitor for suspicious access patterns related to order payment receipts.