The vulnerability is a cross‑site request forgery flaw in the Advanced Classifieds & Directory Pro plugin that allows an attacker to submit forged requests on behalf of a logged‑in user. Without proper nonce validation, an attacker can trigger any state‑changing operation that the user is authorized to perform, such as editing listings, managing categories, or changing plugin settings. This can lead to unauthorized data modifications and potential loss of data integrity (CWE‑352).

WordPress sites that use pluginsware Advanced Classifieds & Directory Pro plugin any version up to and including 3.2.9 are affected.

The CVSS score of 4.3 indicates a moderate risk; the EPSS score of less than 1% suggests low exploit probability in the wild, and the vulnerability is not currently listed in the CISA KEV catalog. Exploitation would require an attacker to craft a malicious link or form that the user visits while authenticated. Because the flaw allows state changes through standard HTTP requests, an attacker can trigger arbitrary actions provided the user has the necessary privileges.