Unauthorized Data Exposure in Finale Lite WordPress Plugin

Executive Summary

CVE-2026-78138 is a vulnerability in the Finale Lite WordPress plugin versions before 2.21.0. It allows any authenticated user with at least a Subscriber role to access sensitive campaign configuration and scheduling data through an unprotected AJAX action. The flaw involves the wcct_quick_view_html function exposing this data for arbitrary post IDs.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your WordPress site uses the Finale Lite plugin version prior to 2.21.0. You can verify the plugin version via the WordPress admin panel under Plugins. Alternatively, use WP-CLI with the command: wp plugin list --name=finale-lite. If the version is below 2.21.0, the site is vulnerable.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to read private campaign settings and schedules, potentially exposing business strategies or sensitive information. Since it requires only a Subscriber role, the attack surface is broad for WordPress sites using vulnerable versions.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially affect compliance with GDPR and HIPAA by exposing sensitive campaign configuration and scheduling data to unauthorized users. Unauthorized access to such data may violate data protection requirements under these regulations, particularly if the data includes personally identifiable information or protected health information.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the Finale Lite plugin to version 2.21.0 or later through the WordPress admin panel or via WP-CLI using: wp plugin update finale-lite. Ensure only authorized users have access to the WordPress admin dashboard to prevent unauthorized exploitation.

Useful 0 Not Useful 0