CVE-2025-15700

HighCVSS 8.8

Published: 09/10/2026(UTC)Updated: 09/10/2026(UTC)Translated: 09/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.19%

8th percentile - higher than 8% of all known CVEs

Summary

The AWP Classifieds WordPress plugin before 4.4.9 does not validate the type of files extracted from an uploaded ZIP archive during its listing-import feature. This allows users with the plugin's management capability to upload arbitrary PHP files to a publicly accessible, network-shared directory and achieve remote code execution.

Risk Assessment

An attacker with management privileges can execute arbitrary code on the server, leading to full system compromise. This poses a critical threat to confidentiality, integrity, and availability.

Recommendation

Update the AWP Classifieds plugin to version 4.4.9 or later. Restrict management privileges and check public directories for unwanted PHP files.

Other vulnerabilities in AWP Classifieds WordPress plugin

CVE-2026-96904Medium
The AWP Classifieds WordPress plugin before 4.4.9 does not verify that a request is authorised to view a listing when a payment transaction is referenced, allowing unauthenticated attackers to bypass ownership checks and read private contact emails on any listing.

Original NVD description (English source)

The AWP Classifieds WordPress plugin before 4.4.9 does not validate the type of files extracted from an uploaded ZIP archive during its listing-import feature, allowing users with the AWP Classifieds WordPress plugin before 4.4.9's management capability to upload arbitrary PHP files to a publicly accessible, network-shared directory and achieve remote code execution.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS