CVE-2026-11801highCWE-862

CVE-2026-11801: fallo de gravedad alta en gwin WPAdverts – Classifieds Plugin

WPAdverts <= 2.3.2 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via classifieds-types REST Endpoint

Publicada el

Seguir esta CVE+ Monitorear WPAdverts – Classifieds Plugin

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

36Vexday Risk Score

Corrige pronto. Ella tiene exploit funcional público.

ssvc Attendcvss 7.5epss 1.6%
The WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.3.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve internal site configuration data exposed by the classifieds-types REST endpoint, including registered post types, labels, associated taxonomies, form scheme metadata, contact options, and custom field meta keys.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Productos afectados
gwin · WPAdverts – Classifieds Plugin
CVEs relacionadas — gwin WPAdverts – Classifieds Plugin

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-10890MEDIUMWPAdverts – Classifieds Plugin <= 2.1.7 - Reflected Cross-Site ScriptingEPSS 0.6%CVE-2024-10108HIGHWPAdverts – Classifieds Plugin <= 2.1.6 - Unauthenticated Stored Cross-Site Scripting via adverts_add ShortcodeEPSS 0.4%CVE-2026-100178HIGHWPAdverts <= 2.3.4 - Unauthenticated Stored Cross-Site Scripting via 'adverts_location' ParameterEPSS 0.4%