WordPress Plugin Vulnerabilities

Classified Listing – Classified ads & Business Directory Plugin < 4.0.5 - Unauthenticated Settings Exposure

Description

The Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.0.4 via the rtcl_taxonomy_settings_export function. This makes it possible for unauthenticated attackers to extract sensitive data including API keys and tokens.

Affects Plugins

Plugin icon
classified-listing
Fixed in 4.0.5

References

CVE
CVE-2025-1063
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/e701b771-59f2-4783-b0a1-bea4d6c3d245

Classification

Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
A3: Sensitive Data Exposure
CWE
CWE-200
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
wesley (wcraft)
Verified
No
WPVDB ID
75f91a7e-e171-43ee-b593-14544dd3ae7b

Timeline

Publicly Published
2025-02-24 (about 1 year ago)
Added
2025-02-24 (about 1 year ago)
Last Updated
2025-02-25 (about 1 year ago)

Other

Published
Title
Published
2025-10-10
Title
WP Gmail SMTP <= 1.0.7 - Sensitive Information Exposure
Published
2025-12-12
Title
WPGraphQL Smart Cache < 2.0.1 - Unauthenticated Private Content Disclosure
Published
2022-10-12
Title
AliExpress Dropshipping and Fulfilment for WooCommerce < 1.1.1 - Unauthenticated Sensitive Data Exposure
Published
2026-04-27
Title
Templately – Elementor & Gutenberg Template Library: 6500+ Free & Pro Ready Templates And Cloud! < 3.6.2 - Authenticated (Contributor+) Information Exposure
Published
2026-01-12
Title
EventPrime - Events Calendar, Bookings and Tickets < 4.2.8.0 - Unauthenticated Sensitive Information Exposure via REST API