CVE-2026-19074: 
WordPress vulnerability analysis and mitigation

CVE-2026-19074 is an unauthenticated sensitive information disclosure vulnerability in the Advanced Classifieds & Directory Pro WordPress plugin (versions <= 3.4.2) by Pluginsware. It allows any unauthenticated remote attacker to read custom field values of arbitrary listings — including those with pending, draft, or private post status — via the AJAX action acadp_public_custom_fields_listings. The vulnerability was publicly disclosed on August 7, 2026, and a patch was released in version 3.4.3. It carries a CVSS v3.1 base score of 5.3 (Medium) (WPScan, GitHub Advisory).

The root cause is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) and CWE-352 (Cross-Site Request Forgery). The vulnerable callback function ajax_callback_custom_fields() in public/user.php (line 553) is registered for unauthenticated users via the WordPress hook wp_ajax_nopriv_acadp_public_custom_fields_listings (in includes/init.php, line 396). It accepts an attacker-controlled post_id parameter and passes it directly to get_post_meta() without performing any authorization, ownership, or post status check. Although check_ajax_referer() is called, it only provides CSRF protection — not authorization — because the nonce (acadp_ajax_nonce) is publicly available to all visitors via wp_localize_script() on any frontend page. Retrieved meta values are subsequently rendered into HTML input field value attributes via the custom-fields.php template (WPScan).

An unauthenticated attacker can read custom field values of any listing regardless of its post status, including pending, draft, or private listings not intended to be publicly accessible. Custom fields in directory plugins commonly store sensitive user-submitted data such as phone numbers, addresses, pricing details, and private notes. The impact is limited to confidentiality (no integrity or availability impact), but the exposed data could facilitate targeted phishing, social engineering, or privacy violations against listing owners (WPScan, GitHub Advisory).

No public proof-of-concept exploit code is currently available; WPScan has indicated a PoC will be published on August 21, 2026, to allow time for users to update. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.097–0.121% (2nd percentile), indicating a low near-term exploitation probability. However, the attack is fully automatable — requiring no authentication, no user interaction, and low complexity — making mass scanning feasible once a PoC is released (WPScan, GitHub Advisory).

1. Reconnaissance: Identify WordPress sites running the Advanced Classifieds & Directory Pro plugin version <= 3.4.2 using tools like WPScan, Shodan, or by checking publicly visible plugin metadata in page source.
2. Obtain the public nonce: Visit any frontend page of the target WordPress site and inspect the page source or JavaScript variables to retrieve the acadp_ajax_nonce value, which is exposed to all visitors via wp_localize_script().
3. Enumerate listing post IDs: Identify valid listing post IDs by browsing the site's directory listings or by iterating through common WordPress post ID ranges.
4. Send crafted AJAX request: Submit an unauthenticated HTTP POST request to the WordPress AJAX endpoint (/wp-admin/admin-ajax.php) with the following parameters: action=acadp_public_custom_fields_listings, security=<nonce>, and post_id=<target_post_id>.
5. Extract sensitive data: Parse the HTML response, which will contain custom field values (e.g., phone numbers, addresses, private notes) of the targeted listing rendered into input field value attributes, even if the listing is in draft, pending, or private status (WPScan).

• Network: Unusual volume of HTTP POST requests to /wp-admin/admin-ajax.php with action=acadp_public_custom_fields_listings from unauthenticated (non-logged-in) sources; sequential or rapid iteration over different post_id values in POST body.
• Logs: WordPress or web server access logs showing repeated unauthenticated POST requests to admin-ajax.php with the acadp_public_custom_fields_listings action parameter, especially from a single IP or small IP range.
• Logs: Requests containing a valid acadp_ajax_nonce value paired with varying post_id values targeting non-public listings (IDs corresponding to draft/pending/private posts).

Update the Advanced Classifieds & Directory Pro plugin to version 3.4.3 or later, which addresses the missing authorization check (WPScan, GitHub Advisory). If immediate patching is not possible, consider temporarily disabling the plugin or using a web application firewall (WAF) rule to block unauthenticated POST requests to /wp-admin/admin-ajax.php with action=acadp_public_custom_fields_listings. Restricting access to the AJAX endpoint at the web server level (e.g., via .htaccess or Nginx configuration) is an additional short-term mitigation until the patch can be applied.

The vulnerability was discovered and reported by researcher Shikhali Jamalzade (Twitter: @0xAlisAlive), who also submitted it to WPScan. WPScan verified the report and published the advisory on August 7, 2026, with a coordinated PoC disclosure date of August 21, 2026, to allow users time to update (WPScan). No broader media coverage or notable community discussion has been observed at this time.