Awp Classifieds
Monthly
Remote code execution in the AWP Classifieds WordPress plugin before 4.4.9 allows an authenticated user holding the plugin's management capability to import a crafted ZIP archive whose contents are extracted without file-type validation, planting arbitrary PHP into a publicly accessible, network-shared directory. Because the extraction target is web-reachable, the uploaded PHP can be requested and executed, yielding code execution under the web server account. Exploitation is gated by the required management capability (CVSS PR:L), and a vendor patch is available in 4.4.9; publicly available exploit code exists and EPSS is low at 0.19% (8th percentile), with no CISA KEV listing indicating confirmed active exploitation. CWE-434 (unrestricted upload of a file with a dangerous type) is the root cause class.
Unauthenticated SQL injection in the AWP Classifieds WordPress plugin (≤4.4.7) allows remote attackers to extract sensitive data from the database via crafted HTTP requests, potentially exposing user information and other site data. The vulnerability exists in the plugin's handling of unsanitized input, enabling attackers to perform SQL injection without authentication. No public exploit or active exploitation has been reported at this time.
Availability-impacting broken access control in the AWP Classifieds (Another WordPress Classifieds Plugin) WordPress plugin through version 4.4.4 allows unauthenticated remote attackers to invoke privileged functionality due to a missing authorization check (CWE-862). The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:N/I:N/A:H) indicates the flaw exposes a sensitive action - most plausibly a destructive or resource-consuming operation - over the network with no credentials or user interaction. No public exploit identified at time of analysis.
SQL injection in AWP Classifieds plugin for WordPress versions up to 4.4.5 allows remote unauthenticated attackers to extract sensitive database contents via array key manipulation in the 'regions' parameter. The vulnerability stems from insufficient escaping of user input in search functionality, affecting the plugin's query integration and page search components. With CVSS 7.5 (AV:N/AC:L/PR:N/UI:N) and no authentication required, this poses significant risk to WordPress sites running this classifieds plugin, though no public exploit or active exploitation has been identified at time of analysis.
Unauthenticated information disclosure in the AWP Classifieds WordPress plugin before version 4.4.9 lets remote attackers read the private contact email address stored on any listing by submitting a request to the ad submission page that references a payment transaction. The plugin omits the ownership/authorisation check on that code path, so no account, login, or user interaction is required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, score 5.3); the only exposure is the listing's private contact email, not credentials, content modification, or site control. Publicly available exploit code exists and WPScan published a proof-of-concept write-up, but there is no KEV entry and EPSS is low at 0.19% (8th percentile), so this is a genuine low-to-moderate priority issue affecting only sites running this optional plugin with listings that store private contact emails.
Broken Access Control in AWP Classifieds (Another WordPress Classifieds Plugin) version 4.4.7 and earlier permits unauthenticated remote attackers to perform unauthorized actions against the plugin's content management functions, resulting in limited integrity compromise. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) confirms no authentication is required and the attack is trivially executable over the network with no user interaction, though impact is bounded to integrity only with no confidentiality or availability loss. No active exploitation has been confirmed by CISA KEV and no public exploit code has been identified at time of analysis.
Missing Authorization vulnerability in AWP Classifieds Team AWP Classifieds.3.1. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability in AWP Classifieds Team Ad Directory & Listings by AWP Classifieds plugin <= 4.3 versions. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The WordPress Classifieds Plugin WordPress plugin before 4.3 does not properly sanitise and escape some parameters before using them in a SQL statement via an AJAX action available to unauthenticated. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection vulnerability in the Another WordPress Classifieds Plugin plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the keywordphrase parameter in a dosearch. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Cross-site scripting (XSS) vulnerability in the Another WordPress Classifieds Plugin plugin for WordPress allows remote attackers to inject arbitrary web script or HTML via the query string to the. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
Remote code execution in the AWP Classifieds WordPress plugin before 4.4.9 allows an authenticated user holding the plugin's management capability to import a crafted ZIP archive whose contents are extracted without file-type validation, planting arbitrary PHP into a publicly accessible, network-shared directory. Because the extraction target is web-reachable, the uploaded PHP can be requested and executed, yielding code execution under the web server account. Exploitation is gated by the required management capability (CVSS PR:L), and a vendor patch is available in 4.4.9; publicly available exploit code exists and EPSS is low at 0.19% (8th percentile), with no CISA KEV listing indicating confirmed active exploitation. CWE-434 (unrestricted upload of a file with a dangerous type) is the root cause class.
Unauthenticated SQL injection in the AWP Classifieds WordPress plugin (≤4.4.7) allows remote attackers to extract sensitive data from the database via crafted HTTP requests, potentially exposing user information and other site data. The vulnerability exists in the plugin's handling of unsanitized input, enabling attackers to perform SQL injection without authentication. No public exploit or active exploitation has been reported at this time.
Availability-impacting broken access control in the AWP Classifieds (Another WordPress Classifieds Plugin) WordPress plugin through version 4.4.4 allows unauthenticated remote attackers to invoke privileged functionality due to a missing authorization check (CWE-862). The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:N/I:N/A:H) indicates the flaw exposes a sensitive action - most plausibly a destructive or resource-consuming operation - over the network with no credentials or user interaction. No public exploit identified at time of analysis.
SQL injection in AWP Classifieds plugin for WordPress versions up to 4.4.5 allows remote unauthenticated attackers to extract sensitive database contents via array key manipulation in the 'regions' parameter. The vulnerability stems from insufficient escaping of user input in search functionality, affecting the plugin's query integration and page search components. With CVSS 7.5 (AV:N/AC:L/PR:N/UI:N) and no authentication required, this poses significant risk to WordPress sites running this classifieds plugin, though no public exploit or active exploitation has been identified at time of analysis.
Unauthenticated information disclosure in the AWP Classifieds WordPress plugin before version 4.4.9 lets remote attackers read the private contact email address stored on any listing by submitting a request to the ad submission page that references a payment transaction. The plugin omits the ownership/authorisation check on that code path, so no account, login, or user interaction is required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, score 5.3); the only exposure is the listing's private contact email, not credentials, content modification, or site control. Publicly available exploit code exists and WPScan published a proof-of-concept write-up, but there is no KEV entry and EPSS is low at 0.19% (8th percentile), so this is a genuine low-to-moderate priority issue affecting only sites running this optional plugin with listings that store private contact emails.
Broken Access Control in AWP Classifieds (Another WordPress Classifieds Plugin) version 4.4.7 and earlier permits unauthenticated remote attackers to perform unauthorized actions against the plugin's content management functions, resulting in limited integrity compromise. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) confirms no authentication is required and the attack is trivially executable over the network with no user interaction, though impact is bounded to integrity only with no confidentiality or availability loss. No active exploitation has been confirmed by CISA KEV and no public exploit code has been identified at time of analysis.
Missing Authorization vulnerability in AWP Classifieds Team AWP Classifieds.3.1. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability in AWP Classifieds Team Ad Directory & Listings by AWP Classifieds plugin <= 4.3 versions. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The WordPress Classifieds Plugin WordPress plugin before 4.3 does not properly sanitise and escape some parameters before using them in a SQL statement via an AJAX action available to unauthenticated. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection vulnerability in the Another WordPress Classifieds Plugin plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the keywordphrase parameter in a dosearch. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Cross-site scripting (XSS) vulnerability in the Another WordPress Classifieds Plugin plugin for WordPress allows remote attackers to inject arbitrary web script or HTML via the query string to the. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.