CVE-2026-19074 PUBLISHED

Advanced Classifieds & Directory Pro < 3.4.3 - Unauthenticated Non-Public Listing Custom Field Disclosure

Assigner: WPScan
Reserved: 06.08.2026 Published: 10.08.2026 Updated: 10.08.2026

The Advanced Classifieds & Directory Pro Advanced Classifieds & Directory Pro WordPress plugin before 3.4.3 (<= 3.4.2) is vulnerable to unauthenticated sensitive information exposure via the AJAX action acadp_public_custom_fields_listings.

Product Status

Vendor Unknown
Product Advanced Classifieds & Directory Pro
Versions Default: unaffected
  • affected from 0 to 3.4.3 (excl.)

Credits

  • Shikhali Jamalzade finder
  • WPScan coordinator

References

Problem Types

  • CWE-200 Information Exposure CWE
  • CWE-352 Cross-Site Request Forgery (CSRF) CWE