What is the CVSS score of CVE-2026-5100?

CVE-2026-5100 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

How to fix or mitigate CVE-2026-5100?

Within 24 hours: Identify all WordPress instances running AWP Classifieds plugin and document installed versions. Within 7 days: Either upgrade to version 4.4.6 or later (if available from vendor) or deactivate and remove the plugin; if upgrade is unavailable, implement Web Application Firewall rules to block requests with array syntax in the 'regions' parameter. Within 30 days: Conduct database audit for unauthorized access logs during plugin operation period; review access controls and implement prepared statements or parameterized queries if plugin is custom-forked.

AWP Classifieds CVE-2026-5100

EUVD-2026-27188 HIGH

SQL Injection (CWE-89)

2026-05-05 Wordfence

WordPress SQLi Wordpress Plugin Awp Classifieds Strategy11Team

7.5

CVSS 3.1 · NVD

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Access public WordPress search page
Delivery

Submit crafted 'regions' parameter with SQL in array keys
Exploit

Trigger unsanitized query construction
Execution

Execute injected SQL commands
Impact

Extract database contents

Vulnerability Assessment

Weakness	CWE CWE-89 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization Parameterized queries, prepared statements MITRE ATT&CK 2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	The WordPress site must have AWP Classifieds plugin version 4.4.5 or earlier installed and active. The plugin's search functionality must be accessible to unauthenticated users, which is the default configuration as classifieds search is typically a public-facing feature. The vulnerable code paths are triggered when the 'regions' parameter is processed during search operations on the frontend page-search-ads.php and through the query integration class. No special authentication, user interaction, or non-default configuration is required-this is remote unauthenticated exploitation against default plugin deployments. The only limiting factor is that the site must specifically use the AWP Classifieds plugin rather than other WordPress classifieds solutions.
Impact	Real-world risk is HIGH despite the absence of confirmed exploitation. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates this is remotely exploitable without authentication or user interaction with low attack complexity, making it trivially exploitable once discovered. The Confidentiality impact is HIGH, meaning attackers can extract the entire WordPress database including user credentials, API keys, and customer data. However, Integrity and Availability impacts are NONE, limiting the attack to data exfiltration rather than defacement or denial of service. No EPSS score is available for this recent CVE, and it is not listed in CISA KEV, suggesting no widespread automated exploitation yet. No public proof-of-concept code has been identified. The primary risk factor is the unauthenticated attack vector combined with WordPress's massive attack surface-plugins with SQL injection are routinely targeted by automated scanners once disclosed. The vulnerability requires the site to have the AWP Classifieds plugin installed and the search functionality accessible, which is the plugin's core feature, so most installations are vulnerable by default.
Exploit ScenarioDerived	An unauthenticated remote attacker crafts a malicious HTTP request to a WordPress site's classifieds search page, manipulating the 'regions' parameter to include SQL injection payloads in array keys rather than values (e.g., regions[' OR 1=1 UNION SELECT user_login,user_pass FROM wp_users--]=1). The plugin's insufficient input validation allows this crafted parameter to be incorporated directly into the SQL query. The attacker can then execute arbitrary SQL commands to extract sensitive data from the WordPress database, including administrator credentials, user personal information, payment details, or API keys stored in the wp_options table. Multiple exploitation attempts can map the entire database schema and exfiltrate all contents without triggering authentication mechanisms.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – May 05, 2026

SQL injection in AWP Classifieds plugin for WordPress versions up to 4.4.5 allows remote unauthenticated attackers to extract sensitive database contents via array key manipulation in the 'regions' parameter. The vulnerability stems from insufficient escaping of user input in search functionality, affecting the plugin's query integration and page search components. With CVSS 7.5 (AV:N/AC:L/PR:N/UI:N) and no authentication required, this poses significant risk to WordPress sites running this classifieds plugin, though no public exploit or active exploitation has been identified at time of analysis.

RemediationAI

Upgrade AWP Classifieds plugin to version 4.4.6 or later immediately, as the 'up to and including 4.4.5' designation implies a fix exists in subsequent releases. Verify the installed version in WordPress admin under Plugins and update through the WordPress dashboard or manually from the official WordPress plugin repository. If immediate patching is not feasible, implement these compensating controls: disable or restrict access to the plugin's search functionality by removing search shortcodes from public pages or implementing Web Application Firewall (WAF) rules to block requests containing 'regions' parameter with suspicious array key patterns (note: this may break legitimate search functionality for users filtering by region). Deploy database activity monitoring to detect anomalous queries including UNION statements, sleep functions, or information_schema queries originating from the plugin. As a last resort, temporarily deactivate the AWP Classifieds plugin entirely until patching can occur, understanding this will disable all classifieds functionality on the site. Review the Wordfence advisory and WordPress Trac repository links for technical details to inform mitigation decisions.

Affected VersionsENISA

AWP Classifieds 0 ≤4.4.5

Affected Packages

euvd awp_classifieds no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

This is a classic SQL injection vulnerability (CWE-89) in WordPress plugin code. The AWP Classifieds plugin (CPE: cpe:2.3:a:strategy11team:awp_classifieds) fails to properly sanitize array keys in the 'regions' parameter before incorporating them into SQL queries. The vulnerable code paths span multiple files including functions.php, page-search-ads.php, class-awpcp.php, and class-query-integration.php as evidenced by the Trac repository references. WordPress plugins must use prepared statements with proper parameterization or WordPress's $wpdb->prepare() method to prevent SQL injection. In this case, the plugin directly concatenates user-supplied array keys into SQL queries without escaping, allowing attackers to inject arbitrary SQL commands. The vulnerability specifically affects the search functionality where regional filters are processed, enabling second-order SQL injection through parameter pollution techniques targeting array key manipulation rather than just values.

Know when Awp Classifieds gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

DescriptionCVE.org

The AWP Classifieds plugin for WordPress is vulnerable to SQL Injection via the 'regions' parameter array keys in versions up to, and including, 4.4.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Executive ViewAI

Why It Matters

The AWP Classifieds WordPress plugin (versions up to 4.4.5) contains a SQL injection vulnerability that allows unauthenticated attackers to extract sensitive database contents without user interaction, potentially exposing customer data, credentials, and business intelligence stored in WordPress databases. Organizations running this plugin face immediate risk of data breach and must prioritize remediation or deactivation.

Business Impact: High

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: (1) Deactivate and remove AWP Classifieds plugin immediately if not critical to operations; (2) If plugin is required, implement WAF rules blocking requests containing array notation (e.g., 'regions[]') in query parameters; (3) Restrict database user permissions to least-privilege access; (4) Enable database activity monitoring and alerting for unusual SELECT queries; (5) Consider migrating to alternative classifieds solution with current security maintenance.

Threat Intelligence Overview

EPSS Score

0.1%

Top 72% exploitable

Data Quality

4 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.1%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.