CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
The ListingPro - WordPress Directory & Listing Theme for WordPress is vulnerable to Sensitive Data Exposure in versions before 2.6.1 via the ~/listingpro-plugin/functions.php file. This makes it possible for unauthenticated attackers to extract sensitive data including usernames, full names, email addresses, phone numbers, physical addresses and user post counts.
Explanation of Vulnerability in Simple Terms
ListingPro WordPress theme versions before 2.6.1 expose sensitive information to unauthenticated attackers over the network. The vulnerability allows an attacker to read data that should be restricted, such as user details or private listing information. No user interaction or special privileges are required to exploit this flaw. Site administrators should update to version 2.6.1 or later immediately.
What an attacker can do
Read sensitive information from the site without logging in, such as user data or private listings.
Potential impact on your site
Visitor and user data may be exposed to anyone on the internet without your knowledge.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
