Advanced Classifieds & Directory Pro < 3.4.3 - Unauthenticated Non-Public Listing Custom Field Disclosure

Description

The Advanced Classifieds & Directory Pro plugin (<= 3.4.2) is vulnerable to unauthenticated sensitive information exposure via the AJAX action `acadp_public_custom_fields_listings`.

The callback function `ajax_callback_custom_fields()` (public/user.php, line 553) is registered for unauthenticated users via `wp_ajax_nopriv_acadp_public_custom_fields_listings` (includes/init.php, line 396). It accepts an attacker-controlled `post_id` parameter and passes it directly to `get_post_meta()` without performing any authorization, ownership, or post status check. The retrieved meta values are subsequently rendered into HTML input field `value` attributes via the `custom-fields.php` template.

An unauthenticated remote attacker can exploit this to read custom field values of arbitrary listings — including those with `pending`, `draft`, or `private` post status that are not intended to be publicly accessible. Custom fields in directory plugins commonly store sensitive user-submitted data such as phone numbers, addresses, pricing details, and private notes.

The `check_ajax_referer()` call present in the function provides CSRF protection only; it does not constitute an authorization control, as the nonce (`acadp_ajax_nonce`) is publicly available to all visitors via `wp_localize_script()` on any frontend page (public/public.php, line 555).

Vulnerable code (public/user.php:553–578):

public function ajax_callback_custom_fields( $post_id = 0 ) {
if ( isset( $_POST['security'] ) && isset( $_POST['post_id'] ) ) {
check_ajax_referer( 'acadp_ajax_nonce', 'security' ); // CSRF only — no authorization
$post_id = (int) $_POST['post_id']; // attacker-controlled
// *** NO ownership check ***
// *** NO post status check ***
// *** NO capability check ***
}
$post_meta = get_post_meta( $post_id ); // arbitrary listing meta retrieved
// $post_meta values echoed into HTML input value attributes (custom-fields.php:33–34)
}