CVE-2026-96904

AWP Classifieds < 4.4.9 - Unauthenticated Listing Contact Email Disclosure via Place Ad Page

The AWP Classifieds WordPress plugin before 4.4.9 does not verify that a request is authorised to view a listing when a payment transaction is referenced, allowing unauthenticated attackers to bypass the ownership check on the ad submission page and read the private contact email stored on any listing.

Affected

AWP Classifieds

CVSS v3.1 CNA

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

0.29% chance of exploitation in the next 30 days, 21st percentile

Published

2026-10-14

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/b3df7272-9b79-4a3c-b230-6c3e97c4bbe5/

References

• CVE Record
• NVD entry