CVE-2026-19074 in Advanced Classifieds & Directory Pro Plugin
Summary
by MITRE • 08/10/2026
The Advanced Classifieds & Directory Pro Advanced Classifieds & Directory Pro WordPress plugin before 3.4.3 (<= 3.4.2) is vulnerable to unauthenticated sensitive information exposure via the AJAX action `acadp_public_custom_fields_listings`.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/10/2026
The vulnerability exists within the Advanced Classifieds & Directory Pro WordPress plugin version 3.4.2 and earlier, where an insecure implementation allows unauthorized access to sensitive data through the AJAX endpoint acadp_public_custom_fields_listings. This flaw represents a critical security oversight that enables attackers to bypass authentication mechanisms and extract confidential information without proper authorization. The vulnerability stems from insufficient input validation and access control measures within the plugin's administrative interface, specifically targeting the custom fields listings functionality.
The technical implementation of this vulnerability resides in the improper handling of AJAX requests within the WordPress plugin architecture. When an attacker sends a crafted request to the acadp_public_custom_fields_listings endpoint, the system fails to verify whether the requester possesses legitimate privileges to access the requested data. This design flaw aligns with CWE-284 Access Control Issues, where insufficient controls allow unauthorized users to perform privileged actions or access restricted resources. The vulnerability operates at the application layer and can be exploited through standard web application attack vectors, making it particularly dangerous in environments where WordPress plugins are widely deployed.
The operational impact of this vulnerability extends beyond simple information disclosure, as it allows attackers to obtain detailed listings of custom fields used within classified advertisements. This exposure could reveal sensitive business data including user registration requirements, listing categories, pricing structures, and other proprietary information that could be leveraged for further attacks. Attackers might use the exposed data to craft more sophisticated social engineering campaigns or identify potential targets for additional exploitation attempts. The vulnerability also represents a significant risk to user privacy as it may expose personal information collected through custom field implementations.
Mitigation strategies should focus on immediate patching of the plugin to version 3.4.3 or later, which addresses the access control flaw through proper authentication verification and input sanitization. System administrators should implement additional monitoring of AJAX endpoints for unusual access patterns and consider implementing web application firewalls to detect and block malicious requests targeting known vulnerable endpoints. The vulnerability demonstrates the importance of following secure coding practices including principle of least privilege enforcement and comprehensive input validation as outlined in the OWASP Top Ten security principles. Organizations should also conduct regular security assessments of their WordPress plugin ecosystem to identify similar vulnerabilities that could compromise system integrity and data confidentiality.
This vulnerability exemplifies how seemingly minor access control oversights can create significant security risks within content management systems, particularly when plugins extend core functionality without proper security validation. The exposure affects not only individual sites but potentially entire networks of WordPress installations that rely on the same vulnerable plugin versions, highlighting the cascading impact of such vulnerabilities in the broader web application ecosystem.