5.3
Medium
CVE-2026-96904 The AWP Classifieds WordPress plugin before 4.4.9 does not verify that a request is authorised to view a listing when…
Description
The AWP Classifieds WordPress plugin before 4.4.9 does not verify that a request is authorised to view a listing when a payment transaction is referenced, allowing unauthenticated attackers to bypass the ownership check on the ad submission page and read the private contact email stored on any listing.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| AWP Classifieds 4.4 | earliest → < 4.4.9 | 4.4.9 |