CVE-2026-19074CWE-200CWE-352information-disclosurecsrf

CVE-2026-19074

Medium · published August 10, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
6.4
In the wild
Unconfirmed
What it is

The Advanced Classifieds & Directory Pro Advanced Classifieds & Directory Pro WordPress plugin before 3.4.3 (<= 3.4.2) is vulnerable to unauthenticated sensitive information exposure via the AJAX action `acadp_public_custom_fields_listings`.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00173 · 6.4th percentile
Weaknesses
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor; CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2026-08-10T11:16Z
References (1)
https://wpscan.com/vulnerability/657cb9f9-8be6-4841-b8a1-93d26a3d7984/ · [email protected]
EPSS history
Timeline
  • 10 AUG 06:00Z
    Advanced Classifieds & Directory Pro < 3.4.3 - Unauthenticated Non-Public Listing Custom Field Disclosure
    cvelistv5