What is the CVSS score of EUVD-2026-48081?

EUVD-2026-48081 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

AWP Classifieds EUVD-2026-48081

| CVE-2026-65469 MEDIUM

Missing Authorization (CWE-862)

2026-07-23 Patchstack

GHSA-mf55-cgjw-rpg2

WordPress Authentication Bypass Wordpress Plugin Awp Classifieds Strategy11 Team

5.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

5.3 MEDIUM

Network-accessible unauthenticated endpoint with missing authorization yields PR:N and AV:N; integrity-only impact bounded to plugin scope justifies I:L and S:U.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 13:25 vuln.today

DescriptionCVE.org

Unauthenticated Broken Access Control in AWP Classifieds <= 4.4.7 versions.

AnalysisAI

Broken Access Control in AWP Classifieds (Another WordPress Classifieds Plugin) version 4.4.7 and earlier permits unauthenticated remote attackers to perform unauthorized actions against the plugin's content management functions, resulting in limited integrity compromise. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) confirms no authentication is required and the attack is trivially executable over the network with no user interaction, though impact is bounded to integrity only with no confidentiality or availability loss. No active exploitation has been confirmed by CISA KEV and no public exploit code has been identified at time of analysis.

Technical ContextAI

AWP Classifieds (Another WordPress Classifieds Plugin) by Strategy11 Team is a WordPress plugin enabling classified ad listing functionality on WordPress sites. The root cause is CWE-862 (Missing Authorization), a class of flaw where one or more server-side actions - such as ad creation, modification, or deletion - are executed without verifying whether the requesting party holds sufficient permission. In WordPress plugin architectures, this typically manifests as unprotected AJAX handlers, REST API endpoints, or form-submission hooks that omit capability checks (e.g., current_user_can()). The CPE string cpe:2.3:a:strategy11_team:awp_classifieds:*:*:*:*:*:*:*:* confirms all versions of the Strategy11 Team product through 4.4.7 are affected. The Patchstack report tags this as an Authentication Bypass, consistent with unauthorized invocation of privileged plugin functionality by unauthenticated users.

RemediationAI

Upgrade AWP Classifieds beyond version 4.4.7 once Strategy11 Team releases a patched build; monitor the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/another-wordpress-classifieds-plugin/vulnerability/wordpress-awp-classifieds-plugin-4-4-7-broken-access-control-vulnerability for a confirmed fix version, as none is specified in currently available data. As an interim compensating control, temporarily disable the plugin if unauthenticated classified ad submission is not a business requirement - this eliminates the attack surface entirely at the cost of plugin functionality. If the plugin must remain active, deploy a WAF rule to block unauthenticated POST requests to the plugin's known AJAX or REST endpoints (e.g., paths containing /wp-admin/admin-ajax.php with AWP-specific action parameters), accepting that legitimate guest submissions may also be blocked. Restricting access to the WordPress site to authenticated users only is the strongest compensating control but may not be feasible for public-facing classifieds sites.