CVE-2026-23546: 
WordPress vulnerability analysis and mitigation

CVE-2026-23546 is a Sensitive Data Exposure vulnerability (CWE-201: Insertion of Sensitive Information Into Sent Data) affecting the RadiusTheme Classified Listing WordPress plugin. It allows authenticated attackers with at least Subscriber-level privileges to retrieve embedded sensitive data that should not be accessible to regular users. The vulnerability affects all versions of the plugin up to and including 5.3.4, with version 5.3.5 containing the fix. It carries a CVSS v3.1 base score of 6.5 (Medium), was reported on November 14, 2025, and publicly disclosed on February 23, 2026 (Patchstack).

The vulnerability is classified under CWE-201 (Insertion of Sensitive Information Into Sent Data), meaning the plugin inadvertently includes sensitive data in responses sent to authenticated users who should not have access to it. The attack vector is network-based, requires low privileges (Subscriber role), no user interaction, and low attack complexity, making it straightforward to exploit for any registered user on an affected WordPress site. The flaw was discovered by security researcher 'daroo' and reported through Patchstack's Active VDP program (Patchstack).

Successful exploitation allows a low-privileged authenticated attacker to access sensitive information that is normally restricted from regular users, resulting in a high confidentiality impact with no integrity or availability impact. The exposed data could potentially be leveraged to facilitate further attacks against the WordPress site or its users, such as privilege escalation or targeted phishing. The scope is limited to the affected system, but the information disclosure could serve as a stepping stone for more severe exploitation (Patchstack).

No public proof-of-concept exploit code has been identified for this vulnerability. The EPSS score is approximately 0.018% (0.000180), indicating a low probability of exploitation in the wild in the near term. There is no evidence of active in-the-wild exploitation or threat actor attribution at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, Patchstack notes that medium-severity vulnerabilities of this type are commonly used in mass-exploit campaigns targeting WordPress sites at scale (Patchstack).

1. Reconnaissance: Identify WordPress sites running the Classified Listing plugin by RadiusTheme at version 5.3.4 or earlier using tools like WPScan or Shodan with WordPress-specific fingerprinting.
2. Account Registration: Register or obtain a low-privileged account (Subscriber level) on the target WordPress site, as the vulnerability requires authentication.
3. Trigger Sensitive Data Exposure: Send authenticated HTTP requests to the plugin's endpoints or API routes that improperly include sensitive data in their responses (e.g., using a browser, curl, or Burp Suite to intercept and analyze API responses).
4. Extract Sensitive Data: Review the response payloads for embedded sensitive information (such as private user data, configuration details, or other restricted fields) that should not be returned to a Subscriber-level user.
5. Leverage Exposed Data: Use the retrieved sensitive information to facilitate further attacks, such as targeting other users, escalating privileges, or crafting more targeted exploits against the site (Patchstack).

• Network: Unusual or repeated authenticated HTTP GET/POST requests from low-privileged user accounts to Classified Listing plugin API endpoints or REST routes, particularly from unfamiliar IP addresses.
• Logs: WordPress access logs showing Subscriber-level accounts making frequent requests to plugin-specific endpoints (e.g., paths containing /wp-json/ or plugin-specific REST routes) in short time windows.
• Logs: Authentication events for newly registered or rarely active Subscriber accounts followed immediately by API enumeration activity.

The vendor, RadiusTheme, has released version 5.3.5 of the Classified Listing plugin which resolves this vulnerability; all users should update immediately. Patchstack has also issued a virtual patch (mitigation rule) for its users to block exploitation attempts until the plugin is updated. As an additional measure, site administrators should review user registration settings and consider restricting open registration if Subscriber-level accounts are not required (Patchstack).

The vulnerability was assigned a medium priority by Patchstack, which noted that vulnerabilities of this class are frequently leveraged in mass-exploit campaigns against WordPress sites. The CVE was mentioned on social media via CVEnew automated accounts shortly after disclosure. No significant independent researcher commentary or major media coverage has been identified beyond the Patchstack advisory (Patchstack).