CVE-2026-96904

MediumCVSS 5.3

Published: 14/10/2026(UTC)Updated: 14/10/2026(UTC)Translated: 14/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.19%

8th percentile - higher than 8% of all known CVEs

Summary

The AWP Classifieds WordPress plugin before 4.4.9 does not verify that a request is authorised to view a listing when a payment transaction is referenced, allowing unauthenticated attackers to bypass ownership checks and read private contact emails on any listing.

Risk Assessment

Attackers can access private seller contact data, compromising confidentiality and potentially enabling abuse.

Recommendation

Update the AWP Classifieds plugin to version 4.4.9 or later, which includes the fix.

Other vulnerabilities in AWP Classifieds WordPress plugin

CVE-2025-15700High
The AWP Classifieds WordPress plugin before 4.4.9 does not validate the type of files extracted from an uploaded ZIP archive during its listing-import feature. This allows users with the plugin's management capability to upload arbitrary PHP files to a publicly accessible, network-shared directory and achieve remote code execution.

Original NVD description (English source)

The AWP Classifieds WordPress plugin before 4.4.9 does not verify that a request is authorised to view a listing when a payment transaction is referenced, allowing unauthenticated attackers to bypass the ownership check on the ad submission page and read the private contact email stored on any listing.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS