The vulnerability identified as CVE-2026-27092 affects the WPAdverts plugin by Greg Winiarski. It is caused by missing authorization controls, which means that certain actions or data may be accessible without proper permission checks. This issue impacts all versions up to 2.3.0. The CVSS vector indicates the attack can be performed remotely over the network with low complexity and requires low privileges but no user interaction. The impact is primarily on confidentiality, with no integrity or availability impact reported.

Successful exploitation could allow an attacker with low privileges to access sensitive information that should be restricted, leading to a confidentiality breach. There is no reported impact on data integrity or system availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, review and tighten access control configurations where possible to limit exposure.