CVE-2026-11801: WPAdverts Plugin Auth Bypass Vulnerability

CVE-2026-11801 Overview

CVE-2026-11801 is an authorization bypass vulnerability in the WPAdverts – Classifieds Plugin for WordPress. The flaw affects all versions up to and including 2.3.2. The plugin fails to verify that requesters are authorized to invoke the classifieds-types REST endpoint. Unauthenticated attackers can retrieve internal site configuration data, including registered post types, labels, associated taxonomies, form scheme metadata, contact options, and custom field meta keys. The weakness is tracked under [CWE-862] Missing Authorization. Version 2.3.3 introduces a capability check that closes the exposure.

Critical Impact
Unauthenticated remote attackers can enumerate sensitive WPAdverts configuration data over the network without user interaction, aiding reconnaissance for follow-on attacks.

Affected Products

WPAdverts – Classifieds Plugin for WordPress, versions up to and including 2.3.2
Fixed in WPAdverts – Classifieds Plugin version 2.3.3
Any WordPress site exposing the plugin's REST API routes

Discovery Timeline

2026-08-18 - CVE-2026-11801 published to the National Vulnerability Database (NVD)
2026-08-20 - Last updated in the NVD database

Technical Details for CVE-2026-11801

Vulnerability Analysis

The vulnerability resides in the WPAdverts REST route registration logic implemented in includes/class-rest-blocks.php. In version 2.3.2, the classifieds-types route is registered without a permission_callback that enforces authenticated or privileged access. As a result, any HTTP client can query the endpoint and receive structured JSON describing the plugin's internal configuration. The response includes post type definitions, taxonomy bindings, form scheme metadata, contact routing options, and the meta keys used for custom fields. This data is intended for administrative UI consumption and should not be reachable by anonymous callers. Attackers commonly use such disclosures to map a target's classifieds workflow, identify hidden fields, and craft precise follow-on requests against other plugin endpoints.

Root Cause

The root cause is a missing authorization check on a WordPress REST API route. The route handler executed its data-gathering logic without validating the caller's capabilities, matching the pattern described by [CWE-862]. The upstream fix, visible in the WPAdverts 2.3.3 source and the plugin changeset, adds a capability check to the route so that only authorized users can invoke it.

Attack Vector

Exploitation requires only network access to the target WordPress site. An attacker sends an unauthenticated HTTP GET request to the WPAdverts REST endpoint under /wp-json/. The server responds with the internal configuration payload. No user interaction, credentials, or privileges are required. The disclosed data is limited to configuration metadata; the vulnerability does not, on its own, allow modification of content or code execution.

No verified exploit code is available. See the Wordfence advisory and the vulnerable route source at line 13 and line 50 for technical details.

Detection Methods for CVE-2026-11801

Indicators of Compromise

Unauthenticated HTTP GET requests to WordPress REST paths matching /wp-json/wpadverts/* or routes referencing classifieds-types.
HTTP 200 responses returning JSON that includes fields such as post_types, taxonomies, form_scheme, contact, or custom field meta_key entries.
Sequential or scripted access patterns from a single source IP enumerating multiple WPAdverts REST routes.

Detection Strategies

Inventory WordPress deployments and identify sites running WPAdverts at or below version 2.3.2 using plugin version telemetry or file-hash checks on class-rest-blocks.php.
Enable WordPress and web server access logging, then alert on anonymous requests to WPAdverts REST endpoints.
Deploy a web application firewall rule that flags unauthenticated calls to the classifieds-types route until patching is complete.

Monitoring Recommendations

Forward WordPress access logs and WAF alerts into a centralized SIEM or data lake for correlation with reconnaissance activity against other plugins.
Baseline normal REST API traffic per site and alert on volume spikes or unusual user-agents hitting /wp-json/ routes.
Track outbound crawlers and vulnerability scanners that specifically probe WordPress plugin REST namespaces.

How to Mitigate CVE-2026-11801

Immediate Actions Required

Update the WPAdverts – Classifieds Plugin to version 2.3.3 or later on every affected WordPress site.
Audit REST API access logs since the plugin was installed to identify prior enumeration attempts.
Rotate any secrets or non-public identifiers that may have been referenced in exposed custom field metadata.

Patch Information

The vendor addressed the issue in WPAdverts version 2.3.3. The fix adds a capability check to the previously open REST route in includes/class-rest-blocks.php. Review the WordPress plugin changeset and the patched source at line 49 to validate deployment.

Workarounds

Restrict access to /wp-json/wpadverts/* routes at the web server or WAF layer until the plugin is upgraded.
Temporarily deactivate the WPAdverts plugin on sites that cannot be updated immediately.
Require authentication on the WordPress REST API by filtering rest_authentication_errors to reject anonymous callers where site functionality permits.

bash

# Example WAF rule (nginx) blocking anonymous access to the vulnerable route
location ~* /wp-json/wpadverts/ {
    if ($http_cookie !~ "wordpress_logged_in") {
        return 403;
    }
}