CVE-2026-19074: 
WordPress 취약성 분석 및 완화

CVE-2026-19074 is an unauthenticated sensitive information disclosure vulnerability in the Advanced Classifieds & Directory Pro WordPress plugin affecting versions up to and including 3.4.2. The flaw allows any unauthenticated remote attacker to read custom field values of arbitrary listings — including those with non-public post statuses such as pending, draft, or private — via the AJAX action acadp_public_custom_fields_listings. It was publicly disclosed on August 7, 2026, and a patch was released in version 3.4.3. The vulnerability is classified as Medium severity with a CVSS score of 5.3, and is tracked under CWE-200 (Information Exposure) (WPScan, GitHub Advisory).

The root cause is a missing authorization check in the ajax_callback_custom_fields() function located in public/user.php (line 553), registered for unauthenticated users via the WordPress hook wp_ajax_nopriv_acadp_public_custom_fields_listings in includes/init.php (line 396). The function accepts an attacker-controlled post_id POST parameter and passes it directly to get_post_meta() without performing any ownership, capability, or post status verification. Although check_ajax_referer() is called, it only provides CSRF protection — the required nonce (acadp_ajax_nonce) is publicly exposed to all site visitors via wp_localize_script() on any frontend page (public/public.php, line 555), rendering it ineffective as an access control. The retrieved metadata is then rendered into HTML input field value attributes via the custom-fields.php template, exposing the raw values to the attacker (CWE-200) (WPScan).

An unauthenticated remote attacker can read custom field metadata from any listing post, regardless of its publication status, including draft, pending, and private posts not intended for public access. Custom fields in directory plugins commonly store sensitive user-submitted data such as phone numbers, physical addresses, pricing details, and private notes, meaning exploitation could expose personally identifiable information (PII) of listing owners and their customers. The impact is limited to confidentiality — there is no evidence of integrity or availability impact — but the data exposed could facilitate targeted phishing, social engineering, or further attacks against affected users (WPScan, GitHub Advisory).

No public proof-of-concept (PoC) exploit code has been released as of the disclosure date; WPScan has indicated the PoC will be published on August 21, 2026, to allow time for users to update. There is no evidence of active in-the-wild exploitation at this time. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The attack requires no authentication and is exploitable over the network using only a publicly available nonce, making it low-complexity once the PoC is released (WPScan, GitHub Advisory).

1. Reconnaissance: Identify WordPress sites running the Advanced Classifieds & Directory Pro plugin at version 3.4.2 or earlier. This can be done by checking the plugin's readme.txt file at /wp-content/plugins/advanced-classifieds-and-directory-pro/readme.txt or by observing plugin-specific markup in page source.
2. Obtain the public nonce: Load any frontend page of the target WordPress site and inspect the page source or JavaScript variables for acadp_ajax_nonce, which is exposed to all visitors via wp_localize_script().
3. Enumerate listing post IDs: Identify valid listing post IDs by browsing the site's directory listings or by iterating over common integer IDs in subsequent requests.
4. Send the malicious AJAX request: Submit an unauthenticated HTTP POST request to the site's AJAX endpoint (/wp-admin/admin-ajax.php) with the following parameters:
   • action=acadp_public_custom_fields_listings
   • security=<obtained_nonce>
   • post_id=<target_listing_id>
5. Extract sensitive data: Parse the HTML response, which will contain the custom field values (e.g., phone numbers, addresses, private notes) of the targeted listing rendered into input field value attributes, even if the listing is in draft, pending, or private status (WPScan).

• Network: Unusual volume of unauthenticated HTTP POST requests to /wp-admin/admin-ajax.php with action=acadp_public_custom_fields_listings from a single or rotating IP address; sequential or iterative post_id values in POST body parameters suggesting enumeration.
• Logs: WordPress or web server access logs showing repeated POST requests to admin-ajax.php with the acadp_public_custom_fields_listings action from unauthenticated sessions (no valid session cookie); requests originating from automated tools (e.g., unusual User-Agent strings or high request frequency).
• Application: Requests containing a valid acadp_ajax_nonce value paired with non-public listing post IDs (IDs corresponding to draft, pending, or private posts) in the post_id parameter.

The vendor has released a patched version: Advanced Classifieds & Directory Pro 3.4.3, which should be applied immediately via the WordPress plugin update mechanism. If immediate patching is not feasible, administrators should consider temporarily deactivating the plugin or blocking unauthenticated POST requests to /wp-admin/admin-ajax.php with action=acadp_public_custom_fields_listings at the web server or WAF level. Longer term, site administrators should audit custom field data stored in listings to assess what sensitive information may have been exposed (WPScan, GitHub Advisory).

The vulnerability was discovered and reported by researcher Shikhali Jamalzade (Twitter: @0xAlisAlive), who submitted it to WPScan. WPScan verified the report and published the advisory on August 7, 2026, with the PoC withheld until August 21, 2026, to allow a remediation window. No significant broader media coverage or notable community commentary beyond the initial disclosure has been observed at this time (WPScan).