CVE-2026-11801highCWE-862

CVE-2026-11801: high-severity vulnerability in gwin WPAdverts – Classifieds Plugin

WPAdverts <= 2.3.2 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via classifieds-types REST Endpoint

Published

Follow this CVE+ Monitor WPAdverts – Classifieds Plugin

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

36Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendcvss 7.5epss 1.6%
The WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.3.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve internal site configuration data exposed by the classifieds-types REST endpoint, including registered post types, labels, associated taxonomies, form scheme metadata, contact options, and custom field meta keys.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
gwin · WPAdverts – Classifieds Plugin
Related CVEs — gwin WPAdverts – Classifieds Plugin

In the same product, most dangerous first.

CVE-2024-10890MEDIUMWPAdverts – Classifieds Plugin <= 2.1.7 - Reflected Cross-Site ScriptingEPSS 0.6%CVE-2024-10108HIGHWPAdverts – Classifieds Plugin <= 2.1.6 - Unauthenticated Stored Cross-Site Scripting via adverts_add ShortcodeEPSS 0.4%CVE-2026-100178HIGHWPAdverts <= 2.3.4 - Unauthenticated Stored Cross-Site Scripting via 'adverts_location' ParameterEPSS 0.4%