Authorization Bypass Vulnerability in WPAdverts Classifieds Plugin

The WPAdverts - Classifieds Plugin for WordPress, versions up to and including 2.3.2, contains an authorization bypass vulnerability identified as CVE-2026-11801. This flaw stems from a failure in the plugin to properly verify user permissions before executing actions within the classifieds-types REST API endpoint. As a result, an unauthenticated attacker can query the endpoint to retrieve internal site configuration metadata. This exfiltrated information includes registered post types, labels, associated taxonomies, form scheme metadata, contact options, and custom field meta keys. Such information disclosure facilitates reconnaissance, allowing attackers to better understand the target environment's structure for subsequent exploitation or targeted attacks against specific forms and data structures.

Impact

Successful exploitation allows unauthenticated attackers to harvest internal WordPress site configuration data. This reconnaissance data provides an attacker with deep insight into the site's data architecture, which is a critical precursor to identifying further vulnerabilities in custom forms or taxonomy-based operations.

Recommendation

• Update the WPAdverts - Classifieds Plugin to the latest available version (beyond 2.3.2) immediately to patch the authorization logic in the classifieds-types endpoint.
• Monitor web server access logs for anomalous, high-frequency requests originating from unauthenticated sources to REST API endpoints associated with the wp-adverts plugin.
• Implement request rate limiting on the REST API for endpoints associated with the plugin to prevent automated scraping of configuration metadata.