WPAdverts <= 2.3.2 Unauth Sensitive Info Disclosure (CVE-2026-11801)

Vulnerability Overview Vulnerability Name: WPAdverts <= 2.3.2 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via classifieds-types REST Endpoint CVE ID: CVE-2026-11801 CVSS Score: 7.5 (High) Publication Date: August 17, 2026 Last Updated: August 18, 2026 Researcher: Deva Panek Affected Scope Software Type: Plugin Software Name: WPAdverts - Classifieds Plugin Affected Versions: <= 2.3.2 Fixed Version: 2.3.3 Remediation Remediation Measure: Update to version 2.3.3 or newer patched versions Vulnerability Description The WPAdverts - Classifieds Plugin for WordPress contains an authorization bypass vulnerability affecting all versions 2.3.2 and earlier. Due to insufficient validation of user permissions to perform actions, attackers can exploit the classifieds-types REST endpoint to retrieve internal site configuration data, including registered post types, tags, associated taxonomies, form schema metadata, contact options, and custom field keys. References plugins.trac.wordpress.org Additional Information Sharing Options: Facebook, Twitter, LinkedIn, Email Recent Vulnerability List WPAdverts - Classifieds Plugin <= 2.3.1 - Unauthenticated Stored Cross-Site Scripting - CVE ID: CVE-2026-57366 - CVSS Score: 7.2 - Researcher: Evan NR - Publication Date: July 1, 2026 WPAdverts - Classifieds Plugin <= 2.3.0 - Missing Authorization - CVE ID: CVE-2026-40782 - CVSS Score: 5.3 - Researcher: TheNetRunner Security Research - Publication Date: April 22, 2026 WPAdverts - Classifieds Plugin <= 2.3.0 - Missing Authorization - CVE ID: CVE-2026-27092 - CVSS Score: 4.3 - Researcher: theviper17 - Publication Date: January 7, 2026 WPAdverts - Classifieds Plugin <= 2.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting - CVE ID: CVE-2025-54024 - CVSS Score: 6.4 - Researcher: zaim - Publication Date: July 16, 2025 WPAdverts - Classifieds Plugin <= 2.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting - CVE ID: CVE-2025-49878 - CVSS Score: 6.4 - Researcher: zaim - Publication Date: June 12, 2025 WPAdverts - Classifieds Plugin <= 2.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting - CVE ID: CVE-2025-48269 - CVSS Score: 6.4 - Researcher: zaim - Publication Date: May 19, 2025 WPAdverts - Classifieds Plugin <= 2.2.2 - Authenticated (Contributor+) Local File Inclusion - CVE ID: CVE-2025-47440 - CVSS Score: 8.8 - Researcher: zaim - Publication Date: May 7, 2025 WPAdverts - Classifieds Plugin <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting - CVE ID: CVE-2025-59576 - CVSS Score: 6.4 - Researcher: Muhammad Yudha - DJ - Publication Date: April 16, 2025 WPAdverts - Classifieds Plugin <= 2.1.7 - Reflected Cross-Site Scripting - CVE ID: CVE-2024-10890 - CVSS Score: 6.1 - Researcher: Peter Thaleikis - Publication Date: November 20, 2024 WPAdverts - Classifieds Plugin <= 2.1.6 - Unauthenticated Stored Cross-Site Scripting via adverts_add Shortcode - CVE ID: CVE-2024-10108 - CVSS Score: 7.2 - Researcher: Arkadiusz Hydzik - Publication Date: October 29, 2024 Additional Information Copyright Information: © 2012-2026 Defiant Inc. All Rights Reserved Business Hours: 9am-8pm ET, 6am-5pm PT, and 2pm-1am UTC/GMT (excluding weekends and holidays) Response Time: 24/7 support, 365 days a year, 1-hour response time Contact Information Technical Support: support@wordfence.com Other Links Terms of Service Privacy Policy and Notice at Collection Do Not Sell or Share My Personal Information Social Media Facebook Twitter LinkedIn Instagram Products and Services Products: Wordfence Free, Wordfence Premium, Wordfence Care, Wordfence Response, Wordfence CLI, Wordfence Intelligence, Wordfence Central Support: Documentation, Learning Center, Free Support, Premium Support News: Blog, In The News, Vulnerability Advisories About: About Wordfence, Affiliate Program, Employment, Contact, Security, CVE Request Form Subscription Stay Updated: Register to receive news and updates from experienced security professionals Additional Information Wordfence Intelligence WordPress Plugin: Completely free access and API querying; please refer to the documentation to understand how to access and use the vulnerability data API Additional Information Wordfence Intelligence Vulnerability Database API: Completely free to query and use, containing all the same vulnerability data as the user interface. Please refer to the API documentation and Webhook documentation for more information Additional Information Wordfence Intelligence: Completely free access and API querying; please refer to the documentation to understand how to access and use the vulnerability data API Additional Information Wordfence Intelligence: Completely free access and API querying; please refer to the documentation to understand how to access and use the vulnerability data API Additional Information Wordfence Intelligence: Completely free access and API querying; please refer to the documentation to understand how to access and use the vuln

Goal Reached Thanks to every supporter — we hit 100%!

WPAdverts <= 2.3.2 Unauth Sensitive Info Disclosure (CVE-2026-11801)

More from this source