Authorization Bypass in WPAdverts WordPress Plugin

Executive Summary

The WPAdverts – Classifieds Plugin for WordPress has an authorization bypass vulnerability in versions up to 2.3.2. This flaw allows unauthenticated attackers to access internal site configuration data through the classifieds-types REST endpoint. The exposed data includes post types, labels, taxonomies, form metadata, contact options, and custom field keys.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if the WPAdverts plugin version is 2.3.2 or lower. Inspect network traffic for requests to the classifieds-types REST endpoint. Look for unauthorized access attempts or unusual data exposure from this endpoint.

Useful 0 Not Useful 0

Impact Analysis

Attackers could retrieve sensitive site configuration details without authentication. This may lead to further exploitation, such as unauthorized data access, privilege escalation, or additional attacks targeting exposed metadata. The impact depends on the exposed data and plugin configuration.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could compromise compliance by exposing sensitive data, potentially violating GDPR (data protection) or HIPAA (health information privacy). Unauthorized access to configuration details may indicate insufficient security controls, leading to regulatory penalties or breaches of confidentiality requirements.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the WPAdverts plugin to the latest version beyond 2.3.2. If an update is unavailable, consider disabling the plugin temporarily. Review server logs for signs of exploitation and restrict access to the classifieds-types REST endpoint.

Useful 0 Not Useful 0