Unauthenticated Sensitive Data Exposure in Advanced Classifieds & Directory Pro

Executive Summary

This vulnerability is in the Advanced Classifieds & Directory Pro WordPress plugin versions 3.4.2 and below. It allows unauthenticated attackers to access sensitive custom field data from non-public listings through an exposed AJAX action called acadp_public_custom_fields_listings. The plugin fails to check user authorization or listing status before exposing data like phone numbers, addresses, or private notes.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your WordPress site is running Advanced Classifieds & Directory Pro plugin version 3.4.2 or below. You can use the command: wp plugin list --name=advanced-classifieds-and-directory-pro to verify the installed version.

Useful 0 Not Useful 0

Impact Analysis

If you use this plugin, attackers could steal sensitive information from your private or draft listings without needing to log in. This includes personal details, contact information, or confidential notes, potentially leading to privacy breaches or misuse of data.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate GDPR and HIPAA by exposing personal or sensitive data without authorization. GDPR requires protecting personal data, while HIPAA mandates safeguarding protected health information. A breach could lead to legal penalties or loss of compliance certifications.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the Advanced Classifieds & Directory Pro plugin to version 3.4.3 or later to patch the vulnerability. If updating is not possible, consider disabling the plugin temporarily until an update is applied.

Useful 0 Not Useful 0