AWP Classifieds CVE-2026-65469

The target site must have AWP Classifieds version 4.4.7 or earlier installed and active as a WordPress plugin. No special configuration is required beyond default plugin installation - the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms unauthenticated remote exploitation against default plugin configurations. The primary limiting factor is impact scope: exploitation is bounded to low-integrity effects (I:L) within the plugin's own data (S:U), meaning an attacker cannot exfiltrate user data or disrupt site availability through this vulnerability alone. The affected functionality is specific to AWP Classifieds plugin endpoints; broader WordPress core or other plugins are not within scope.

The NVD CVSS base score of 5.3 (Medium) accurately reflects a constrained but easily reachable attack surface: network-accessible, low complexity, no privileges, no user interaction, unchanged scope, with integrity-only impact. The absence of EPSS data and CISA KEV listing means real-world exploitation probability is unconfirmed, and no public exploit code is known. The integrity impact (I:L) implies unauthorized actors can manipulate classified ad data - submitting, altering, or potentially removing listings - without authentication, but cannot access confidential data or disrupt availability. For sites where content integrity and ad submission authenticity are critical (e.g., paid listings, moderated marketplaces), the practical risk is meaningful. However, without active exploitation evidence and given the scope-unchanged, low-integrity-impact ceiling, this is a medium-priority patch rather than an emergency response. The discrepancy between the 'Authentication Bypass' tag and the CVSS I:L (rather than C:H or full S:C) suggests the bypass enables unauthorized writes but not full privilege escalation or data exfiltration.

An unauthenticated attacker visits a WordPress site running AWP Classifieds 4.4.7 or earlier, identifies the unprotected plugin endpoint (via source enumeration or public plugin documentation), and sends a crafted HTTP POST request that triggers a privileged action - such as submitting a classified ad, modifying an existing listing, or triggering an admin-level plugin function - without presenting any credentials. No public POC has been identified at time of analysis, but the low attack complexity (AV:N/AC:L/PR:N) means exploitation requires only endpoint discovery and a correctly structured request.