The Classified Listing plugin for WordPress contains a sensitive information exposure vulnerability (CWE-200) in the rtcl_taxonomy_settings_export function. This flaw allows unauthenticated remote attackers to extract sensitive data including API keys and tokens from all plugin versions up to 4.0.4. The vulnerability has a CVSS 3.1 base score of 5.3, indicating a medium severity with network attack vector, no privileges required, and no user interaction needed. No official patch or vendor advisory has been published yet, and no known exploits have been reported.

An unauthenticated attacker can retrieve sensitive information such as API keys and tokens from the vulnerable plugin, potentially enabling further unauthorized access or abuse of integrated services. The vulnerability does not affect data integrity or availability directly but compromises confidentiality of sensitive credentials.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling or restricting access to the rtcl_taxonomy_settings_export function or the plugin itself to prevent unauthorized data exposure.