CVE-2026-27092: 
WordPress vulnerability analysis and mitigation

CVE-2026-27092 is a Missing Authorization vulnerability in the WPAdverts WordPress plugin developed by Greg Winiarski. The flaw allows authenticated attackers with low-level privileges to exploit incorrectly configured access control security levels, classified under CWE-862 (Missing Authorization). It affects WPAdverts versions up to and including 2.3.0. The vulnerability was published on February 19, 2026, and carries a CVSS v3.1 base score of 6.5 (Medium) (Feedly).

The root cause is CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether a requesting user has the appropriate permissions before granting access to certain functionality. The attack vector is network-based, requires low privileges (an authenticated user account), no user interaction, and low attack complexity. The vulnerability is categorized as a Broken Access Control issue, where an attacker can exploit incorrectly configured access control security levels to access restricted data or functionality within the plugin (Feedly).

Successful exploitation results in a high confidentiality impact with no effect on integrity or availability. An authenticated attacker with minimal privileges could access sensitive information that should be restricted to higher-privileged users, such as administrative data or private classified ad content managed by the WPAdverts plugin. The scope is limited to the affected WordPress installation, but data exposure risk is significant for sites relying on WPAdverts for classified ad management (Feedly).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.017%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a valid (low-privileged) account on the target WordPress site, which limits the attack surface compared to unauthenticated vulnerabilities (Feedly).

Users should update the WPAdverts plugin to a version beyond 2.3.0 that addresses this authorization flaw. Check the official WordPress plugin repository or the vendor's site for the latest patched release. As a temporary workaround, site administrators can restrict access to WordPress sites to trusted users only and review user role assignments to minimize the number of low-privileged accounts. Monitoring WordPress access logs for unusual requests to WPAdverts plugin endpoints may help detect unauthorized access attempts (Feedly).