CVE-2026-11801CWE-862broken-access-control

CVE-2026-11801

High · published August 18, 2026

CVSS v3.1
7.5
EPSS
2%
Percentile
76.2
In the wild
Unconfirmed
What it is

The WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.3.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve internal site configuration data exposed by the classifieds-types REST endpoint, including registered post types, labels, associated taxonomies, form scheme metadata, contact options, and custom field meta keys.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.01642 · 76.2th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-08-18T07:16Z
References (5)
https://plugins.trac.wordpress.org/browser/wpadverts/tags/2.3.2/includes/class-rest-blocks.php#L13 · [email protected]https://plugins.trac.wordpress.org/browser/wpadverts/tags/2.3.2/includes/class-rest-blocks.php#L50 · [email protected]https://plugins.trac.wordpress.org/browser/wpadverts/tags/2.3.3/includes/class-rest-blocks.php#L49 · [email protected]https://plugins.trac.wordpress.org/changeset?reponame=&new=3635095%40wpadverts%2Ftrunk&old=3557928%40wpadverts%2Ftrunk · [email protected]https://www.wordfence.com/threat-intel/vulnerabilities/id/37bb8d68-dd87-437a-80e5-e99e93dc55b6?source=cve · [email protected]
EPSS history
Timeline
  • 18 AUG 02:27Z
    WPAdverts <= 2.3.2 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via classifieds-types REST Endpoint
    cvelistv5