The vulnerability exists in the Classified Listing WordPress plugin before version 5.3.9, where the payment‑receipt handler does not verify that the order being accessed belongs to the user making the request. This allows an authenticated subscriber to read the payment receipt details of any other user’s order, exposing sensitive transaction information without affecting code execution or system integrity.

The affected product is the Classified Listing plugin for WordPress, specifically all releases prior to 5.3.9. Users of older versions with subscriber‑level accounts are at risk until the plugin is upgraded.

With a CVSS score of 4.3 the severity is considered low, yet the exploit is straightforward: a logged‑in subscriber can supply an order ID to the receipt endpoint and obtain another user's receipt. The EPSS score of less than 1% indicates a very small chance of current exploitation, and the vulnerability is not listed in CISA's KEV catalog. Nonetheless, the lack of authentication checks means any subscriber can readily exploit the flaw if they manually request order IDs or if an attacker can enumerate them.