CVE-2025-1063: 
WordPress vulnerability analysis and mitigation

The Classified Listing – Classified ads & Business Directory Plugin for WordPress contains a Sensitive Information Exposure vulnerability (CVE-2025-1063) affecting all versions up to and including 4.0.4. The vulnerability was discovered and reported by Wordfence, with the initial disclosure on February 25, 2025 (NVD CVE).

The vulnerability exists in the rtcl_taxonomy_settings_export function, which allows unauthenticated attackers to extract sensitive data including API keys and tokens. The vulnerability has been assigned a CVSS v3.1 Base Score of 5.3 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, indicating network accessibility with low attack complexity and no privileges required (NVD CVE).

The vulnerability allows unauthorized access to sensitive information, specifically API keys and tokens, which could potentially be used to compromise the affected WordPress installation or connected services (NVD CVE).

The vulnerability can be exploited by unauthenticated attackers, requiring no user interaction or special privileges. The attack vector is network-accessible, making it potentially exploitable from remote locations (NVD CVE).

A patch has been released to address this vulnerability. Users are advised to update their Classified Listing plugin to a version newer than 4.0.4 (WordPress Patch).