The Advanced Classifieds & Directory Pro WordPress plugin before version 3.4.3 (i.e., versions <= 3.4.2) contains a vulnerability that allows unauthenticated attackers to expose sensitive information via the AJAX action 'acadp_public_custom_fields_listings'. This is an information exposure vulnerability categorized as CWE-200. There is no official remediation level or patch information provided in the available data. The vulnerability has a CVSS 3.1 score of 5.3 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, indicating network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, and limited confidentiality impact.

An unauthenticated attacker can exploit this vulnerability to access sensitive information exposed by the plugin's AJAX action. This could lead to leakage of data that should otherwise be protected. The vulnerability does not affect integrity or availability, only confidentiality to a limited extent.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor the vendor's communications for updates. Until a patch is available, consider restricting access to the vulnerable AJAX endpoint or disabling the plugin if feasible.