CVE-2026-23546: Classified Listing Info Disclosure Flaw

CVE-2026-23546 Overview

CVE-2026-23546 is an Insertion of Sensitive Information Into Sent Data vulnerability (CWE-201) affecting the RadiusTheme Classified Listing plugin for WordPress. This vulnerability allows attackers to retrieve embedded sensitive data from the application, potentially exposing confidential information that should not be accessible to unauthorized users.

The vulnerability exists in versions up to and including 5.3.4 of the Classified Listing plugin, a popular WordPress extension used for creating classified ad websites. The flaw enables malicious actors to extract sensitive data that is inadvertently included in responses sent by the application.

Critical Impact

Attackers can retrieve sensitive data embedded in application responses, potentially exposing user information, configuration details, or other confidential data managed by the Classified Listing plugin.

Affected Products

• RadiusTheme Classified Listing WordPress Plugin versions through 5.3.4

Discovery Timeline

• 2026-03-05 - CVE-2026-23546 published to NVD
• 2026-03-05 - Last updated in NVD database

Technical Details for CVE-2026-23546

Vulnerability Analysis

This vulnerability falls under CWE-201 (Insertion of Sensitive Information Into Sent Data), which occurs when an application includes sensitive information in data sent to an external party. In the context of the Classified Listing plugin, the application fails to properly filter or sanitize responses before sending them to users, resulting in the exposure of sensitive embedded data.

The Classified Listing plugin handles various types of user and listing data, including contact information, transaction details, and potentially authentication-related information. When the plugin generates responses—whether through AJAX calls, REST API endpoints, or rendered page content—it may inadvertently include sensitive information that should be restricted to authenticated administrators or the data owners themselves.

This type of vulnerability typically arises from improper access control checks on data retrieval functions or from debug information being left in production code. Attackers can exploit this by analyzing network responses, API outputs, or HTML source code to identify and extract the exposed sensitive data.

Root Cause

The root cause of CVE-2026-23546 lies in insufficient data filtering within the Classified Listing plugin's response handling mechanisms. The plugin fails to properly sanitize or restrict sensitive information before including it in outbound data, violating the principle of least privilege for data exposure.

This commonly occurs when:

• Database queries return more fields than necessary for the current operation
• Serialized objects containing private data are exposed in API responses
• Debug or verbose mode information is not properly disabled in production
• Access control checks are missing or improperly implemented on data retrieval endpoints

Attack Vector

The attack vector for this vulnerability involves an attacker making requests to the affected WordPress site running the vulnerable Classified Listing plugin. By analyzing the responses returned by the application—including AJAX responses, REST API endpoints, or even rendered HTML—the attacker can identify and extract sensitive information that is embedded in the data.

The vulnerability can be exploited remotely without authentication, as the sensitive data is exposed in responses sent to any requesting party. Attackers may use automated tools to enumerate endpoints and parse responses for sensitive data patterns such as email addresses, personal information, or internal configuration details.

For detailed technical information about this vulnerability, refer to the Patchstack Vulnerability Report.

Detection Methods for CVE-2026-23546

Indicators of Compromise

• Unusual API or AJAX requests targeting Classified Listing plugin endpoints
• Large volumes of requests from single sources attempting to enumerate listing data
• Evidence of data scraping activities targeting user or listing information
• Unauthorized access to sensitive user data appearing in external databases or dark web markets

Detection Strategies

• Monitor HTTP responses from the Classified Listing plugin endpoints for unexpected sensitive data exposure
• Implement web application firewall (WAF) rules to detect reconnaissance patterns targeting plugin endpoints
• Review WordPress access logs for suspicious request patterns to /wp-json/ or AJAX endpoints related to the plugin
• Deploy endpoint detection solutions to identify data exfiltration attempts

Monitoring Recommendations

• Enable verbose logging on the WordPress site to capture all requests to the Classified Listing plugin
• Implement real-time alerting for unusual data access patterns or bulk data retrieval attempts
• Conduct periodic security audits of API responses to ensure sensitive data is not inadvertently exposed
• Monitor for new user registrations or listing activity that may indicate exploitation attempts

How to Mitigate CVE-2026-23546

Immediate Actions Required

• Update the Classified Listing plugin to a patched version (newer than 5.3.4) as soon as available from RadiusTheme
• Review and audit any exposed sensitive data to assess the potential impact
• Implement additional access controls at the web server or WAF level to restrict access to sensitive endpoints
• Consider temporarily disabling the plugin if a patch is not yet available and the site handles highly sensitive data

Patch Information

WordPress site administrators should check for updates to the Classified Listing plugin through the WordPress admin dashboard or directly from RadiusTheme. The patch should address the sensitive data exposure by properly filtering and sanitizing data before it is included in responses.

For additional details on the vulnerability and remediation guidance, consult the Patchstack security advisory.

Workarounds

• Implement server-side output filtering to remove sensitive data from plugin responses
• Use a Web Application Firewall (WAF) with custom rules to sanitize responses from the affected endpoints
• Restrict access to the WordPress REST API and AJAX endpoints to authenticated users only where possible
• Deploy network-level monitoring to detect and block potential data exfiltration attempts

# Example: Restrict access to sensitive plugin endpoints via .htaccess
<IfModule mod_rewrite.c>
    RewriteEngine On
    # Block direct access to sensitive classified listing endpoints
    RewriteCond %{REQUEST_URI} ^/wp-json/classified-listing/ [NC]
    RewriteCond %{HTTP:Authorization} ^$
    RewriteRule ^.*$ - [F,L]
</IfModule>