CVE-2025-1063 Overview
CVE-2025-1063 affects the Classified Listing – Classified ads & Business Directory Plugin for WordPress. The plugin exposes sensitive information through the rtcl_taxonomy_settings_export function in all versions up to and including 4.0.4. Unauthenticated attackers can extract sensitive data including API keys and tokens by invoking the vulnerable export function over the network. The issue is tracked under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.
Critical Impact
Unauthenticated attackers can retrieve API keys, tokens, and other confidential configuration data from affected WordPress sites, enabling downstream account compromise and third-party service abuse.
Affected Products
- Radiustheme Classified Listing plugin for WordPress, all versions through 4.0.4
- WordPress sites using the rtcl_taxonomy_settings_export function
- Deployments configured with third-party API keys or tokens stored in plugin taxonomy settings
Discovery Timeline
- 2025-02-25 - CVE-2025-1063 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-1063
Vulnerability Analysis
The vulnerability resides in the rtcl_taxonomy_settings_export function of the Classified Listing plugin. This function exports taxonomy configuration data but fails to enforce authentication or capability checks before returning results. As a consequence, any remote user can invoke the export routine and retrieve sensitive fields embedded in the taxonomy settings.
The exported data set includes API keys and access tokens used by the plugin to integrate with external services. Exposure of these secrets can facilitate lateral movement into linked platforms, quota abuse, or impersonation of the WordPress site to third-party providers. The vulnerability requires no user interaction and no privileges to exploit.
Root Cause
The root cause is a missing authorization check in the export handler. The function performs its work without verifying current_user_can() or a valid nonce. This design flaw allows anonymous callers to reach an administrative export path intended for privileged users.
Attack Vector
An attacker sends an HTTP request to the exposed endpoint that triggers rtcl_taxonomy_settings_export. The server responds with a serialized dump of taxonomy settings containing embedded secrets. No authentication, session, or user interaction is required, and the attack is fully remote.
Because no verified proof-of-concept has been published, exploitation details are described in prose only. See the Wordfence Vulnerability Report for further technical context.
Detection Methods for CVE-2025-1063
Indicators of Compromise
- Unauthenticated HTTP requests targeting endpoints that invoke rtcl_taxonomy_settings_export
- Outbound activity from third-party services using API keys stored in the Classified Listing plugin, originating from unexpected IP addresses
- Successful HTTP 200 responses returning taxonomy export payloads to anonymous clients
Detection Strategies
- Review WordPress access logs for requests referencing rtcl_taxonomy_settings_export or related admin-ajax actions from unauthenticated sessions
- Correlate export responses with response body sizes larger than typical anonymous requests to identify data extraction
- Audit third-party service dashboards for API key usage anomalies that align with export request timestamps
Monitoring Recommendations
- Enable request logging on the WordPress web server and forward logs to a centralized analytics platform for querying
- Alert on any anonymous request that reaches Classified Listing admin functions or admin-ajax.php handlers tied to the plugin
- Rotate and monitor all API keys and tokens configured within the plugin, and alert on usage outside expected origins
How to Mitigate CVE-2025-1063
Immediate Actions Required
- Update the Classified Listing plugin to a version later than 4.0.4 that includes the fix from WordPress plugin changeset 3241883
- Rotate every API key, token, and credential that was stored in the plugin's taxonomy settings
- Review web server logs for prior unauthenticated invocations of the vulnerable export function
Patch Information
The vendor addressed the issue in the plugin update tracked by WordPress plugin changeset 3241883. The patch adds authorization checks to the export routine to block unauthenticated callers. Site administrators should upgrade to the latest available release from the WordPress plugin repository.
Workarounds
- Restrict access to the plugin's export endpoints using a web application firewall rule that requires an authenticated administrator session
- Temporarily deactivate the Classified Listing plugin on sites that cannot be patched immediately
- Remove or externalize sensitive API keys and tokens from the plugin configuration until patching is complete
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
