AWP Classifieds EUVD-2026-100870

Exploitation is triggered on the plugin's ad submission page when a request references a payment transaction; the plugin fails to verify that the requester is authorized to view the referenced listing, so no authentication, account, or user interaction is required (PR:N/UI:N). The practical requirement is simply a reachable site running AWP Classifieds before version 4.4.9 that has listings with stored private contact emails. The limiting factors are the narrow impact - only the private contact email of a listing is exposed, not credentials, content modification, or site control - and that the affected product is a specific optional WordPress plugin rather than a default or core component, so only sites that installed and use this plugin for listings are affected.

This is a genuine but low-to-moderate priority issue, and the signals are largely consistent with a modest real-world risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms remote, unauthenticated, low-complexity access with no user interaction, which raises concern, but the impact is narrow: only confidentiality is affected and only at a Low level (C:L/I:N/A:N), reflecting disclosure of a single private contact email per listing rather than full data compromise. EPSS is low at 0.19% (8th percentile), and SSVC lists Exploitation as 'none' (i.e. not observed in the wild) with only 'partial' technical impact, so despite 'Automatable: yes' there is no evidence of active exploitation. The vulnerability is NOT on CISA KEV. Public exploit code exists (WPScan), which raises the practical likelihood of opportunistic scanning above what EPSS alone suggests, but POC availability is distinct from active exploitation and should not be read as the latter. Net: a real, patchable information-disclosure flaw worth remediating, but not an emergency - the low impact scope and absence of KEV/active-exploitation signals keep it below critical-triage thresholds.

An unauthenticated attacker crafts a request to the ad submission page referencing a payment transaction identifier, bypassing the ownership check that should restrict listing visibility, and reads the private contact email stored on an arbitrary listing. Because the attack is network-based, low-complexity, and requires no authentication or user interaction, it can be automated to harvest emails across many listings. Publicly available exploit code (via WPScan) lowers the barrier to carrying this out.