Get real-time updates on Telegram
CVE-2026-96904: AWP Classifieds 0 to before 4.4.9
CVE-2026-96904. CVSS 3.1 base score 5.3 (MEDIUM, Source advisory).
Affected technology
AWP Classifieds · 0 to before 4.4.9
Vendor not specified by the source
Description’s affected range: before 4.4.9 does not verify that a request is authorised to view a listing when a payment transaction is referenced
Component: Not specified by the source
Attack conditions (Source advisory, CVSS 3.1): Network (remote) · No privileges required · No user interaction required
What an attacker can do
The source says the AWP Classifieds WordPress plugin before 4.4.9 does not verify that a request is authorised to view a listing when a payment transaction is referenced, allowing unauthenticated attackers to bypass the ownership check on the ad submission page and read the private contact email stored on any listing. Source advisory’s CVSS 3.1 assessment (base score 5.3/10) rates confidentiality impact as low; integrity and availability impact as none.
- CWE
- CWE-200
- CCR priority
- 21.2 /100 (P4)
- CVSS 3.1
- 5.3 /10 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N · Source advisory
- KEV
- no
Provenance
- GitHub Advisory Database · Source record · observed 2026-10-14 16:01:16.619248+00:00 UTC
- NVD CVE API 2.0 · Source record · observed 2026-10-14 16:14:54.592053+00:00 UTC
Stable permalink: https://cybercodered.org/item/cve-cve-2026-96904.html