Wpadverts Classifieds Plugin
Monthly
Unauthenticated access to the classifieds-types REST endpoint in WPAdverts - Classifieds Plugin for WordPress (all versions through 2.3.2) exposes internal site configuration data due to a missing authorization check in class-rest-blocks.php. Remote attackers without any credentials can retrieve registered post types, taxonomy definitions, form schema metadata, contact options, and custom field meta keys - information that supports targeted reconnaissance for follow-on attacks. No public exploit has been identified at time of analysis and this vulnerability is not listed in CISA KEV, but the CVSS AV:N/PR:N vector means any internet-facing WordPress site running the affected plugin version is reachable without precondition.
Unauthenticated access to the classifieds-types REST endpoint in WPAdverts - Classifieds Plugin for WordPress (all versions through 2.3.2) exposes internal site configuration data due to a missing authorization check in class-rest-blocks.php. Remote attackers without any credentials can retrieve registered post types, taxonomy definitions, form schema metadata, contact options, and custom field meta keys - information that supports targeted reconnaissance for follow-on attacks. No public exploit has been identified at time of analysis and this vulnerability is not listed in CISA KEV, but the CVSS AV:N/PR:N vector means any internet-facing WordPress site running the affected plugin version is reachable without precondition.