CVE-2026-42726
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
The AWP Classifieds plugin for WordPress contains a Missing Authorization vulnerability that allows exploiting incorrectly configured access control security levels. The issue affects versions up to and including 4.4.5.
Risk Assessment
An attacker may gain access to functions or data that should be protected, compromising the confidentiality and integrity of the site.
Recommendation
Update the AWP Classifieds plugin to a version later than 4.4.5 and review user permissions.
Other vulnerabilities in AWP Classifieds
See all- CVE-2026-59550Critical
The AWP Classifieds plugin for WordPress version 4.4.7 and earlier contains an unauthenticated SQL injection vulnerability.
- CVE-2026-65469Medium
The AWP Classifieds plugin version 4.4.7 and earlier contains a broken access control vulnerability that can be exploited without authentication. An attacker can gain unauthorized access to functions or data.
- CVE-2026-39533High
Unauthenticated Broken Access Control exists in AWP Classifieds <= 4.4.4 versions.
Original NVD description (English source)
Missing Authorization vulnerability in Strategy11 Team AWP Classifieds another-wordpress-classifieds-plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AWP Classifieds: from n/a through <= 4.4.5.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS