CVE-2026-11801: 
WordPress vulnerability analysis and mitigation

CVE-2026-11801 is an authorization bypass vulnerability in the WPAdverts – Classifieds Plugin for WordPress, affecting all versions up to and including 2.3.2. The flaw allows unauthenticated attackers to access internal site configuration data via the classifieds-types REST endpoint without any authentication or privileges. It was published on August 18, 2026, with Wordfence as the reporting CNA. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) (Wordfence, GitHub Advisory).

The root cause is Missing Authorization (CWE-862): the plugin's class-rest-blocks.php file registers the classifieds-types REST API endpoint without implementing proper permission checks to verify whether the requesting user is authorized to access it. Specifically, the vulnerable code at lines 13 and 50 of class-rest-blocks.php in version 2.3.2 fails to enforce authentication or capability checks before returning sensitive data. An attacker can exploit this by sending a simple unauthenticated HTTP GET request to the WordPress REST API endpoint, requiring no special tools or privileges. The fix was introduced in version 2.3.3, where line 49 of the updated class-rest-blocks.php adds the missing authorization check (Wordfence, WordPress Trac).

Successful exploitation allows unauthenticated remote attackers to retrieve internal WordPress site configuration data exposed by the classifieds-types REST endpoint, including registered post types, labels, associated taxonomies, form scheme metadata, contact options, and custom field meta keys. While there is no direct integrity or availability impact, the exposed metadata can facilitate reconnaissance for further attacks — such as targeted injection attempts against known custom fields or taxonomy structures. The confidentiality impact is rated High, as the leaked data may reveal sensitive site architecture details not intended for public access (GitHub Advisory, Wordfence).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at the time of disclosure. The EPSS score is 0.0, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the low attack complexity and lack of authentication requirements make it trivially exploitable if targeted (GitHub Advisory, Wordfence).

1. Reconnaissance: Identify WordPress sites running the WPAdverts – Classifieds Plugin version 2.3.2 or earlier using tools like WPScan, Shodan, or by checking the plugin's readme.txt file at https://target.com/wp-content/plugins/wpadverts/readme.txt.
2. Identify the REST endpoint: Confirm the vulnerable endpoint is accessible by querying the WordPress REST API discovery endpoint at https://target.com/wp-json/ and looking for the classifieds-types route.
3. Send unauthenticated request: Issue a simple HTTP GET request to the endpoint, e.g., curl -s https://target.com/wp-json/wpadverts/v1/classifieds-types, with no authentication headers or cookies required.
4. Harvest configuration data: Parse the JSON response to extract registered post types, taxonomies, form scheme metadata, contact options, and custom field meta keys for use in further reconnaissance or targeted attacks (Wordfence, WordPress Trac).

• Network: Unauthenticated HTTP GET requests to /wp-json/wpadverts/v1/classifieds-types or similar WPAdverts REST API routes from external IP addresses; repeated or automated requests to this endpoint in web server access logs.
• Logs: WordPress access logs showing requests to the classifieds-types REST endpoint without any authentication tokens (no Authorization header, no session cookies); high-frequency requests from a single IP suggesting automated scanning.
• Process/Behavior: Unusual enumeration of WordPress REST API routes (e.g., requests to /wp-json/ followed immediately by targeted endpoint queries) indicative of automated reconnaissance tools such as WPScan.

Update the WPAdverts – Classifieds Plugin to version 2.3.3 or later, which introduces the missing authorization check on the classifieds-types REST endpoint. If immediate patching is not possible, restrict access to the WordPress REST API at the web server or WAF level, specifically blocking unauthenticated requests to /wp-json/wpadverts/ routes. Monitor web server access logs for suspicious unauthenticated requests to the affected endpoint as a detection measure (Wordfence, WordPress Trac).

The vulnerability was reported and disclosed by Wordfence, which serves as the CNA for this CVE. There is limited broader community discussion, with the vulnerability appearing in standard aggregation feeds (VulDB, Vulners, CIRCL) shortly after publication. A brief mention was noted on the Infosec Exchange Mastodon instance, but no significant researcher commentary or media coverage has been identified beyond routine vulnerability tracking (GitHub Advisory).