AWP Classifieds EUVD-2025-211055

Exploitation requires an authenticated account possessing the AWP Classifieds plugin's management capability (per CVSS PR:L), use of the plugin's listing-import feature which accepts an uploaded ZIP archive, and that the plugin extracts archive contents - without validating file type (CWE-434) - into a publicly accessible, network-shared directory from which the planted PHP can be requested and executed. Limiting factors: the attacker must already hold that privileged capability (not a default unauthenticated visitor), the vulnerable version must be <4.4.9 (patched in 4.4.9), and successful RCE depends on the extraction directory being web-reachable and PHP execution being permitted there. These constraints reduce realistic exposure despite the high CVSS base score.

This is a genuine but conditionally-gated high-severity issue rather than a mass-exploitation emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) yields 8.8 and reflects network reach with low complexity and no user interaction, but it requires PR:L - the attacker must already hold the plugin's management capability, which materially narrows the attacker population to authenticated, privileged plugin operators. CWE-434 plus the described write of arbitrary PHP to a publicly-reachable directory supports the SSVC 'Technical Impact: total' rating, consistent with C:H/I:H/A:H. Signals are coherent but point to limited scale: SSVC marks Exploitation as 'none' and Automatable as 'no', and EPSS is only 0.19% (8th percentile), indicating low predicted real-world exploitation volume. This CVE is NOT in CISA KEV, so there is no confirmed active exploitation. A public exploit (WPScan) does exist, but POC availability is distinct from active exploitation and should not be read as 'in the wild.' Net: a real priority for sites running the vulnerable plugin where the management capability is delegated to semi-trusted or compromisable accounts, but the PR:L gate and low EPSS/SSVC-automatable signals argue against treating it as an unauthenticated internet-wide threat.

An authenticated user holding the AWP Classifieds management capability uses the plugin's listing-import feature to upload a ZIP archive containing a malicious PHP file; because the plugin does not validate extracted file types, the PHP file lands in a publicly accessible, network-shared directory. The attacker then requests that file's URL directly to execute arbitrary code on the server. A public exploit for this flaw is available via WPScan, lowering the effort to reproduce it.