Atomic Edge analysis of CVE-2026-27092:
The vulnerability is a missing authorization check in the WPAdverts – Classifieds Plugin for WordPress, affecting versions up to and including 2.2.11. This flaw allows authenticated attackers with contributor-level permissions or higher to perform unauthorized actions. The CVSS score of 4.3 reflects a medium severity issue.
Atomic Edge research identifies the root cause in the `adext_contact_form_send` hook execution within the file `wpadverts/addons/contact-form/contact-form.php`. The code at line 136 executes the hook without verifying the user’s capability to perform the associated action. The function `adext_contact_form_delete_tmp_files` is subsequently called using a user-controlled `uniqid` parameter retrieved via `adverts_request`. The vulnerability stems from the absence of a capability check, such as `current_user_can`, before the `do_action` call.
An attacker exploits this by crafting a POST request to a WordPress AJAX endpoint or admin-post handler that triggers the `adext_contact_form_send` action. The attacker must be authenticated with at least contributor-level access. The payload includes the parameter `wpadverts-form-upload-uniqid` to specify which temporary files to delete. The request may also require a valid `_wpadverts_checksum` parameter. The exact endpoint is not visible in the diff, but typical WordPress patterns involve `admin-ajax.php` with an `action` parameter or `admin-post.php`.
The patch in version 2.3.0 does not directly address the missing authorization. The diff shows changes to file handling logic and template restrictions, but no added capability check. The primary fix for the missing authorization is not present in the provided code diff. Atomic Edge analysis concludes the patched version likely adds a capability check elsewhere in the codebase not shown in this diff. The visible changes improve input validation for the `uniqid` parameter by adding a type check and sanitization guard.
Successful exploitation allows unauthorized deletion of temporary uploaded files associated with other users’ classified ad submissions. This constitutes a data integrity and availability issue. Attackers can disrupt the normal operation of the contact form feature, potentially causing denial-of-service for specific users by deleting their pending file uploads. The impact is limited to the plugin’s temporary file storage and does not grant full system access.
