The Classified Listing plugin for WordPress is vulnerable to Sensitive Information Exposure through the rtcl_taxonomy_settings_export function. Unauthenticated users can trigger this function and obtain sensitive data such as API keys and tokens, compromising the confidentiality of the site’s integrations.

All installations of the Classified Listing – AI‑Powered Classified ads & Business Directory Plugin from vendor techlabpro1, running any version up to and including 4.0.4, are affected. Any website that has not applied the latest update beyond 4.0.4 remains susceptible.

With a CVSS score of 5.3 and an EPSS score below 1 %, the vulnerability is considered moderate but still exploitable. It is not listed in CISA’s KEV catalog, indicating no widely known public exploits at this time. The likely attack vector is an unauthenticated HTTP request to the exposed export endpoint; an attacker need only identify the plugin’s URL pattern and invoke the function to retrieve the data. The consequences include loss of confidential integration keys, which could allow further compromise of connected services.