CVE-2025-68580: CSRF in Advanced Classifieds & Directory Pro

A successful CSRF attack could allow an attacker to modify classified listings, user profiles, or other sensitive data within the Advanced Classifieds & Directory Pro system. This could result in data breaches, unauthorized account modifications, or even the complete takeover of user accounts. The impact is amplified if the platform is used for business-critical classifieds or directory listings, as attackers could manipulate information to their advantage or disrupt operations. While CSRF typically requires user interaction (e.g., clicking a malicious link), the potential for widespread impact remains significant, especially in environments with shared hosting or where users are less security-aware.

1. Reserved2025-12-19
2. Published2025-12-24
3. Modified2026-04-28
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-68580 is to immediately upgrade Advanced Classifieds & Directory Pro to version 3.3.0 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds such as adding CSRF tokens to all sensitive forms and actions within the plugin. Web Application Firewalls (WAFs) can also be configured to filter out suspicious requests that exhibit CSRF characteristics. Regularly review user permissions and implement the principle of least privilege to limit the potential damage from a successful attack.

Active installs

2KKnown

Plugin rating