PT-2025-7813 · WordPress · The Classified Listing – Classified Ads & Business Directory Plugin

Wesley · Published 2025-02-25 · Updated 2025-02-25 · CVE-2025-1063

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Classified Listing – Classified ads & Business Directory Plugin versions up to, and including, 4.0.4

Description The issue allows unauthenticated attackers to extract sensitive data, including API keys and tokens, via the rtcl taxonomy settings export function. This makes it possible for attackers to access confidential information without authentication.

Recommendations For versions up to, and including, 4.0.4, consider disabling the rtcl taxonomy settings export function until a patch is available to prevent unauthenticated attackers from extracting sensitive data. Restrict access to sensitive information to minimize the risk of exploitation.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2025-1063

Affected Products

The Classified Listing – Classified Ads & Business Directory Plugin

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-1063 · Security Note
• https://osv.dev/vulnerability/CVE-2025-1063 · Vendor Advisory
• https://wordfence.com/threat-intel/vulnerabilities/id/e701b771-59f2-4783-b0a1-bea4d6c3d245?source=cve · Note
• https://plugins.trac.wordpress.org/changeset/3241883/classified-listing · Note
• https://t.me/cvenotify/112397 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1894294832350220397 · Twitter Post
• https://t.me/cvedetector/18862 · Telegram Post
• https://twitter.com/CVEnew/status/1894284810325045553 · Twitter Post