CVE-2026-19074: WordPress ACADP Info Disclosure Flaw

CVE-2026-19074 Overview

CVE-2026-19074 is an unauthenticated sensitive information exposure vulnerability in the Advanced Classifieds & Directory Pro WordPress plugin. Versions up to and including 3.4.2 expose sensitive data through the acadp_public_custom_fields_listings AJAX action. The plugin fails to enforce authentication or authorization checks on this endpoint. Any unauthenticated remote attacker can invoke the action and retrieve custom field data associated with classifieds listings. The issue is categorized under [CWE-200] (Exposure of Sensitive Information to an Unauthorized Actor). The vendor addressed the issue in version 3.4.3.

Critical Impact
Unauthenticated remote attackers can retrieve sensitive custom field data from affected WordPress sites without any user interaction.

Affected Products

Advanced Classifieds & Directory Pro WordPress plugin versions prior to 3.4.3
Advanced Classifieds & Directory Pro version 3.4.2 and earlier
WordPress sites with the vulnerable plugin installed and activated

Discovery Timeline

2026-08-10 - CVE-2026-19074 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-19074

Vulnerability Analysis

The vulnerability resides in the acadp_public_custom_fields_listings AJAX action handler exposed by the Advanced Classifieds & Directory Pro plugin. WordPress AJAX actions registered under wp_ajax_nopriv_ are reachable by unauthenticated visitors through /wp-admin/admin-ajax.php. The handler returns custom field data associated with classifieds listings without validating the caller's identity or session. An attacker can therefore query the endpoint directly and receive data that should only be accessible under controlled conditions. The exposure is limited to confidentiality; the endpoint does not modify data or affect availability.

Root Cause

The root cause is missing authorization on a public AJAX endpoint. The plugin registers acadp_public_custom_fields_listings for unauthenticated access but does not restrict which listing fields or records can be returned. There is no nonce verification, capability check, or contextual authorization applied to the parameters accepted by the handler. This design allows any caller to read custom field values across listings.

Attack Vector

Exploitation requires only network access to a WordPress site running the vulnerable plugin. The attacker sends a crafted HTTP POST request to /wp-admin/admin-ajax.php with the action parameter set to acadp_public_custom_fields_listings. No credentials, tokens, or user interaction are required. The server responds with JSON containing custom field data. Attackers can enumerate listings iteratively to harvest data at scale. Further technical detail is available in the WPScan Vulnerability Report.

Detection Methods for CVE-2026-19074

Indicators of Compromise

Unauthenticated POST or GET requests to /wp-admin/admin-ajax.php containing action=acadp_public_custom_fields_listings
High-volume enumeration patterns against the same endpoint from a single source IP or distributed set of IPs
Anomalous outbound response sizes from admin-ajax.php correlated with the vulnerable action name

Detection Strategies

Inspect web server access logs for requests referencing the acadp_public_custom_fields_listings action string
Deploy web application firewall rules that flag or block unauthenticated requests to this specific AJAX action
Correlate admin-ajax.php request bursts with the absence of an authenticated WordPress session cookie

Monitoring Recommendations

Baseline normal admin-ajax.php traffic volumes and alert on deviations tied to the affected action name
Retain WordPress access logs long enough to support retrospective hunts once indicators are known
Track plugin inventory across WordPress deployments to identify hosts still running versions at or below 3.4.2

How to Mitigate CVE-2026-19074

Immediate Actions Required

Update the Advanced Classifieds & Directory Pro plugin to version 3.4.3 or later on all WordPress installations
Audit existing listings and custom fields to identify any sensitive data that may already have been exposed
Review web server logs for prior exploitation attempts against the vulnerable AJAX action

Patch Information

The vendor released version 3.4.3 of the Advanced Classifieds & Directory Pro plugin to remediate this issue. Administrators should apply the update through the WordPress plugin management interface or via WP-CLI. Refer to the WPScan Vulnerability Report for advisory details.

Workarounds

Temporarily deactivate the Advanced Classifieds & Directory Pro plugin until version 3.4.3 can be applied
Restrict access to /wp-admin/admin-ajax.php requests containing the vulnerable action name using WAF or reverse proxy rules
Remove sensitive information from custom fields on public listings until the update is deployed

bash

# Update the plugin using WP-CLI
wp plugin update advanced-classifieds-and-directory-pro --version=3.4.3

# Verify installed version
wp plugin get advanced-classifieds-and-directory-pro --field=version