CVE-2025-15700highCWE-434

CVE-2025-15700: high-severity vulnerability in AWP Classifieds

AWP Classifieds < 4.4.9 - Admin+ Arbitrary File Upload via ZIP Import

Published

Follow this CVE+ Monitor AWP Classifieds

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

41Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 8.8epss 0.4%
The AWP Classifieds WordPress plugin before 4.4.9 does not validate the type of files extracted from an uploaded ZIP archive during its listing-import feature, allowing users with the AWP Classifieds WordPress plugin before 4.4.9's management capability to upload arbitrary PHP files to a publicly accessible, network-shared directory and achieve remote code execution.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
Unknown · AWP Classifieds
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — AWP Classifieds

In the same product, most dangerous first.

CVE-2026-96904MEDIUMAWP Classifieds < 4.4.9 - Unauthenticated Listing Contact Email Disclosure via Place Ad PageEPSS 0.3%