Deva Parekh

**Name of the Vulnerable Software and Affected Versions** WPAdverts – Classifieds Plugin versions prior to 2.3.3 **Description** An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. This allows unauthenticated attackers to retrieve internal site configuration data through the 'classifieds-types' REST endpoint. The exposed information includes registered post types, labels, associated taxonomies, form scheme metadata, contact options, and custom field meta keys. **Recommendations** Update WPAdverts – Classifieds Plugin to version 2.3.3 or later. Restrict access to the 'classifieds-types' REST endpoint as a temporary mitigation measure.