Description

The WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.3.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve internal site configuration data exposed by the classifieds-types REST endpoint, including registered post types, labels, associated taxonomies, form scheme metadata, contact options, and custom field meta keys.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-18T03:16:38.650Z",
  "pubdate": "2026-08-18T03:16:38.650Z",
  "executiveSummary": "The WPAdverts – Classifieds Plugin plugin for WordPress in all versions up to, and including, 2.3.2 is vulnerable to an authorization bypass. This security flaw stems from the plugin's failure to properly verify whether a requesting user possesses the necessary authorization to perform specific actions. Consequently, unauthenticated remote attackers can leverage this weakness to query the classifieds-types REST endpoint and successfully retrieve sensitive internal site configuration data. The impact of this exposure includes the unauthorized harvesting of registered post types, associated labels, taxonomy associations, form scheme metadata, contact options, and custom field meta keys. This information leakage provides threat actors with structural intelligence regarding the target WordPress installation, which can facilitate subsequent targeted attacks against the application or its underlying database. Exploitation requires no prior authentication or administrative privileges, lowering the attack barrier to any remote user capable of interacting with the vulnerable WordPress REST API endpoint. Mitigation requires updating the plugin to a patched version once available or restricting unauthorized access to the affected REST API route.",
  "technicalDetails": "The vulnerability resides within the REST API implementation of the WPAdverts – Classifieds Plugin, specifically affecting versions up to, and including, 2.3.2. The root cause of the issue is an absolute lack of proper access control checks and permission callbacks on the classifieds-types REST endpoint. In WordPress plugin development, custom REST API endpoints must utilize permission_callback routines to validate the authentication state and capability requirements of the requesting user prior to executing the endpoint handler logic. In this vulnerable component, the API endpoint fails to enforce these checks, allowing public access to resources that should be restricted.\nThe attack flow begins when an unauthenticated remote attacker issues an HTTP request directly to the classifieds-types REST endpoint exposed by the WordPress site. Because the vulnerable endpoint lacks authorization enforcement, the underlying function executes without validating the sender's identity or privileges. Upon execution, the application queries and serializes internal site configuration data, returning it directly in the HTTP response payload to the unauthenticated client.\nThe post-exploitation impact includes the exposure of critical architectural details of the WordPress installation. The retrieved payload encompasses registered post types, interface labels, associated taxonomies, form scheme metadata, contact options, and custom field meta keys. While this data does not directly grant remote code execution or administrative takeover on its own, it significantly reduces the reconnaissance effort required by an attacker to map out the application's data model, uncover hidden input vectors, or craft bespoke secondary exploits targeting custom fields and form handling mechanisms within WPAdverts. Network exposure is broad, as WordPress REST endpoints are publicly accessible by default over HTTP and HTTPS protocols. No authentication, special privileges, or user interaction are required to successfully execute this unauthorized data retrieval."
}