CVE-2026-11801

Name of the Vulnerable Software and Affected Versions WPAdverts – Classifieds Plugin versions prior to 2.3.3

Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. This allows unauthenticated attackers to retrieve internal site configuration data through the 'classifieds-types' REST endpoint. The exposed information includes registered post types, labels, associated taxonomies, form scheme metadata, contact options, and custom field meta keys.

Recommendations Update WPAdverts – Classifieds Plugin to version 2.3.3 or later. Restrict access to the 'classifieds-types' REST endpoint as a temporary mitigation measure.