EUVD-2026-54998
GHSA-ph33-vcq9-wj36
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-accessible unauthenticated public AJAX endpoint; no complexity barrier; impact is low confidentiality only with no integrity or availability exposure.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Advanced Classifieds & Directory Pro Advanced Classifieds & Directory Pro WordPress plugin before 3.4.3 (<= 3.4.2) is vulnerable to unauthenticated sensitive information exposure via the AJAX action acadp_public_custom_fields_listings.
AnalysisAI
Sensitive information exposure in the Advanced Classifieds & Directory Pro WordPress plugin (versions through 3.4.2) allows unauthenticated remote attackers to retrieve custom field listing data via the publicly accessible AJAX action acadp_public_custom_fields_listings, bypassing WordPress authentication entirely. A publicly available proof-of-concept has been published by WPScan, though EPSS places exploitation probability at the 1st percentile, suggesting limited observed exploitation to date. No CISA KEV listing exists, and a vendor-released patch is available in version 3.4.3.
Technical ContextAI
The affected component is the acadp_public_custom_fields_listings AJAX action registered by the Advanced Classifieds & Directory Pro plugin for WordPress. In WordPress, AJAX actions registered with wp_ajax_nopriv_ are reachable by unauthenticated users, and this handler returns custom field data without enforcing any authorization check - the root cause class described by CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). CPE data identifies the affected software as cpe:2.3:a:unknown:advanced_classifieds_&_directory_pro:*:*:*:*:*:*:*:* covering all versions prior to 3.4.3. Custom fields in classifieds plugins commonly store user-submitted contact details, pricing metadata, or other listing attributes that site operators may intend to restrict to authenticated users or administrators.
RemediationAI
The primary fix is to upgrade the Advanced Classifieds & Directory Pro WordPress plugin to version 3.4.3 or later, which resolves the unauthenticated AJAX endpoint exposure; the WPScan advisory at https://wpscan.com/vulnerability/657cb9f9-8be6-4841-b8a1-93d26a3d7984/ provides full disclosure details. If immediate upgrading is not feasible, a WAF rule blocking unauthenticated POST requests to wp-admin/admin-ajax.php with action=acadp_public_custom_fields_listings can serve as a compensating control, though this carries the trade-off of potentially breaking legitimate frontend functionality that uses the same AJAX endpoint. Alternatively, temporarily deactivating the plugin eliminates the exposure entirely at the cost of disabling all classifieds functionality on the site until a patched version is installed.
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today