CVE-2026-11801

CVE-2026-11801 is an authorization bypass in the WPAdverts WordPress plugin that exposes classifieds system metadata to unauthenticated users through the REST API endpoint `/wp-json/adverts/v1/classifieds-types`. The vulnerability isn't a traditional injection or remote code execution — it's an information disclosure that reveals the classifieds subsystem's internal data model, including custom meta keys, form scheme metadata, and taxonomy structures, to anyone who requests it. This matters because WPAdverts is a financial system. It handles user-submitted classified listings, contact forms, and transactions. The meta keys exposed through this endpoint map where personal data and payment information flow through the plugin. An attacker doesn't need to guess which fields store sensitive data — the endpoint hands them a complete blueprint. With that blueprint, they can target specific meta keys for injection attempts, probe contact form handlers by name, and map taxonomy slugs for further enumeration. The information exposure is reconnaissance that converts a hypothetical 'attacker knows about our classifieds plugin' scenario into concrete technical detail. The root cause is structural, not individual negligence. WordPress makes REST endpoint creation trivially easy through `register_rest_route()`, which means developers add endpoints rapidly without friction — but that same frictionlessness means permission checks aren't automatic. The developer who added the `classifieds-types` endpoint almost certainly added it to serve legitimate frontend functionality (populating form dropdowns, rendering term lists), and simply didn't perform the threat modeling step of asking what an attacker learns from seeing the schema. This isn't unique to WPAdverts — the same pattern appears repeatedly in WordPress plugin CVE history, from WooCommerce extensions to contact form handlers. The WordPress security model assumes individual developer threat modeling discipline at a scale the ecosystem's release velocity makes impractical. What you should do: First, verify whether your WPAdverts installation exposes the `/wp-json/adverts/v1/classifieds-types` endpoint to unauthenticated requests — test it from an incognito browser window. If it returns schema metadata without authentication, you are vulnerable. Second, apply any available patch immediately; the fix adds a permission callback to the route that enforces authorization. Third, audit your WordPress installation for other plugins that expose REST API schema endpoints without explicit permission checks — this vulnerability class is a recurring pattern, and WPAdverts is unlikely to be the last instance. Fourth, recognize that this vulnerability's severity is asymmetric: a classifieds plugin exposing financial metadata deserves higher priority than a blog plugin exposing post type labels, even though both might receive the same CVSS base score. The CVSS 7.5 rating measures the vulnerability's technical characteristics, not the sensitivity of what it exposes.

Reviewed through automated stages and approved by a human before publication.