CVE-2026-96904: Unknown Awp Classifieds

Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days.

The AWP Classifieds WordPress plugin before 4.4.9 does not verify that a request is authorised to view a listing when a payment transaction is referenced, allowing unauthenticated attackers to bypass the ownership check on the ad submission page and read the private contact email stored on any listing.

Affected products

• Unknown Awp Classifieds: before 4.4.9 (fixed in 4.4.9)

Published 2026-10-14. Last modified 2026-10-14.