CVE-2026-11801highCWE-862

CVE-2026-11801: falha de alta gravidade em gwin WPAdverts – Classifieds Plugin

WPAdverts <= 2.3.2 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via classifieds-types REST Endpoint

Publicada em

Seguir esta CVE+ Monitorar WPAdverts – Classifieds Plugin

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

36Vexday Risk Score

Corrija em breve. Ela tem exploit funcional público.

ssvc Attendcvss 7.5epss 1.6%
The WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.3.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve internal site configuration data exposed by the classifieds-types REST endpoint, including registered post types, labels, associated taxonomies, form scheme metadata, contact options, and custom field meta keys.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Produtos afetados
gwin · WPAdverts – Classifieds Plugin
CVEs relacionadas — gwin WPAdverts – Classifieds Plugin

No mesmo produto, das mais perigosas para as menos.

CVE-2024-10890MEDIUMWPAdverts – Classifieds Plugin <= 2.1.7 - Reflected Cross-Site ScriptingEPSS 0.6%CVE-2024-10108HIGHWPAdverts – Classifieds Plugin <= 2.1.6 - Unauthenticated Stored Cross-Site Scripting via adverts_add ShortcodeEPSS 0.4%CVE-2026-100178HIGHWPAdverts <= 2.3.4 - Unauthenticated Stored Cross-Site Scripting via 'adverts_location' ParameterEPSS 0.4%