The vulnerability in the DJ-Classifieds extension’s "duplicate my ad" feature allows a logged‑in user to load another user’s ad by providing a raw numeric ID without verifying ownership or publication status. This flaw exposes the seller’s phone number, address, email, and price for any ad, even those never published, resulting in accidental disclosure of sensitive contact information. The impact is limited to confidentiality loss; there is no evidence of code execution, privilege escalation, or denial of service.

The issue affects the DJ-Classifieds extension for Joomla sold by dj‑extensions.com. All releases older than version 3.11.3 contain the flaw. The base Joomla CMS itself is not directly affected unless the vulnerable extension is installed.

A CVSS score of 5.3 indicates moderate severity. An EPSS score is not available, so the likelihood of exploitation cannot be precisely quantified. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires only a Joomla account; a malicious user can supply any numeric ad ID in the request, making enumeration trivial. Once exploited, confidential details are disclosed, but no further system privileges are gained.