CVE-2025-31832: ACF City Selector Information Disclosure

CVE-2025-31832 Overview

CVE-2025-31832 is a sensitive information disclosure vulnerability in the Beee ACF City Selector plugin for WordPress. The flaw affects all versions of acf-city-selector up to and including 1.17.0. It maps to [CWE-497]: Exposure of Sensitive System Information to an Unauthorized Control Sphere. An unauthenticated remote attacker can retrieve embedded sensitive data from the plugin over the network without user interaction. The vulnerability affects confidentiality but does not directly impact integrity or availability. Site owners running the plugin should treat any embedded credentials, tokens, or system data as potentially exposed.

Critical Impact
Unauthenticated network-based retrieval of embedded sensitive data from WordPress sites running ACF City Selector <= 1.17.0.

Affected Products

Beee ACF City Selector plugin for WordPress
Versions from initial release through 1.17.0
WordPress sites with acf-city-selector installed and active

Discovery Timeline

2025-04-01 - CVE-2025-31832 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-31832

Vulnerability Analysis

The ACF City Selector plugin exposes sensitive system information to unauthorized requestors. The weakness is classified under [CWE-497], which covers cases where a product places sensitive information into a resource accessible outside the intended control sphere. An attacker can query the affected component over the network and retrieve data that should remain internal to the WordPress installation. Exploitation requires no authentication, no privileges, and no user interaction. The scope is limited to information disclosure, with no direct write or denial-of-service consequences reported.

Root Cause

The plugin embeds sensitive data within resources or endpoints that lack proper access controls. Because the surrounding component does not restrict who can read this data, the information becomes reachable by any network-facing requestor. This category of flaw commonly results from debug artifacts, verbose responses, or backing files that ship inside the plugin package and remain retrievable through predictable URLs.

Attack Vector

The attack vector is network-based with low complexity. An attacker sends HTTP requests to the WordPress site hosting the vulnerable plugin and parses the response for embedded system data. No credentials, session cookies, or victim interaction are required. Automated scanners can enumerate WordPress installations, fingerprint the plugin version, and harvest disclosed data at scale.

No verified public proof-of-concept code is available. Refer to the Patchstack Vulnerability Report for advisory details.

Detection Methods for CVE-2025-31832

Indicators of Compromise

Unauthenticated HTTP GET requests targeting acf-city-selector plugin paths under /wp-content/plugins/acf-city-selector/
Repeated requests from single source IPs enumerating plugin files or REST endpoints
Access log entries showing responses that contain configuration data, internal identifiers, or database references originating from the plugin

Detection Strategies

Inventory WordPress sites and identify installations running acf-city-selector version 1.17.0 or earlier
Review web server access logs for outbound responses containing sensitive tokens or system paths tied to plugin URLs
Deploy WordPress plugin vulnerability scanners that flag acf-city-selector against the Patchstack advisory

Monitoring Recommendations

Alert on anonymous requests to plugin directories that return non-standard content types or unusually large payloads
Track HTTP 200 responses from acf-city-selector endpoints served to unauthenticated user agents
Correlate WordPress plugin enumeration activity with subsequent access attempts to identified vulnerable paths

How to Mitigate CVE-2025-31832

Immediate Actions Required

Identify all WordPress instances with the ACF City Selector plugin installed and confirm the version in use
Deactivate acf-city-selector on sites running version 1.17.0 or earlier until a fixed release is applied
Rotate any credentials, API keys, or secrets that may have been embedded in or accessible through the plugin

Patch Information

No fixed version is confirmed within the enriched data at the time of publication. Consult the Patchstack Vulnerability Report for the latest vendor guidance and update the plugin to any release that supersedes 1.17.0.

Workarounds

Restrict access to /wp-content/plugins/acf-city-selector/ at the web server or WAF layer for unauthenticated visitors
Remove the plugin entirely if the city selector functionality is not business-critical
Audit plugin files for embedded secrets and remove or externalize any sensitive values before reactivation

bash

# Example nginx block to restrict direct access to plugin files
location ~* /wp-content/plugins/acf-city-selector/.*\.(php|json|txt|log)$ {
    deny all;
    return 403;
}