Skip to content
Sign in
8.8 High

CVE-2025-15700 The AWP Classifieds WordPress plugin before 4.4.9 does not validate the type of files extracted from an uploaded ZIP…

Description

The AWP Classifieds WordPress plugin before 4.4.9 does not validate the type of files extracted from an uploaded ZIP archive during its listing-import feature, allowing users with the AWP Classifieds WordPress plugin before 4.4.9's management capability to upload arbitrary PHP files to a publicly accessible, network-shared directory and achieve remote code execution.

Affected products and versions

Product Affected versions Fixed in
AWP Classifieds 4.4 earliest → < 4.4.9 4.4.9

Other CVEs of AWP Classifieds

The 2 CVEs of AWP Classifieds →
CVE-2026-96904 The AWP Classifieds WordPress plugin before 4.4.9 does not verify that a request is authorised to view a listing when… 5.3 Medium
Track this CVE