CVE-2026-11801 is an authorization bypass vulnerability in the WPAdverts – Classifieds Plugin for WordPress, affecting all versions up to and including 2.3.2. The plugin fails to properly verify user authorization when accessing the classifieds-types REST endpoint, enabling unauthenticated attackers to retrieve sensitive internal configuration data such as registered post types, labels, associated taxonomies, form scheme metadata, contact options, and custom field meta keys. This vulnerability is categorized under CWE-862 (Missing Authorization).

An unauthenticated attacker can retrieve sensitive internal configuration information from the affected WordPress plugin. This exposure could aid further attacks or reconnaissance but does not directly allow modification or denial of service. The CVSS v3.1 base score is 7.5 (High), reflecting the network attack vector, low complexity, no privileges required, no user interaction, and high confidentiality impact with no integrity or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is available at this time. Users should monitor the vendor's communications for updates and consider restricting access to the affected REST endpoints as a temporary mitigation if possible.