HIGH 7.5 NVD
CVE-2026-11801
The WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.3.2. This is due to the pl
The WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.3.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve internal site configuration data exposed by the classifieds-types REST endpoint, including registered post types, labels, associated taxonomies, form scheme metadata, contact options, and custom field meta keys.
References
- https://plugins.trac.wordpress.org/browser/wpadverts/tags/2.3.2/includes/class-rest-blocks
- https://plugins.trac.wordpress.org/browser/wpadverts/tags/2.3.2/includes/class-rest-blocks
- https://plugins.trac.wordpress.org/browser/wpadverts/tags/2.3.3/includes/class-rest-blocks
- https://plugins.trac.wordpress.org/changeset?reponame=&new=3635095%40wpadverts%2Ftrunk&old
- https://www.wordfence.com/threat-intel/vulnerabilities/id/37bb8d68-dd87-437a-80e5-e99e93dc
This high severity vulnerability with a CVSS score of 7.5 was published on 2026-08-18 via NVD.
vulnfeed aggregates 11052 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.