CVE-2026-96904: AWP Classifieds < 4.4.9 - Unauthenticated Listing Contact Email Disclosure via Place Ad Page
The AWP Classifieds WordPress plugin before 4.4.9 does not verify that a request is authorised to view a listing when a payment transaction is referenced, allowing unauthenticated attackers to bypass the ownership check on the ad submission page and read the private contact email stored on any listing.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated attacker can exploit it; no login or listing ownership is required. The attacker must be able to reference a payment transaction associated with a listing.
Which installations are affected?
AWP Classifieds WordPress plugin versions before 4.4.9 are affected. The issue concerns listings that have a payment transaction reference and a private contact email stored on the listing.
What information can be exposed?
The attacker can read the private contact email address stored on an affected listing. The provided information does not indicate exposure of other listing data or account credentials.
How can we tell whether we may be affected?
Check whether the site runs an AWP Classifieds version earlier than 4.4.9 and has listings with payment transactions. Review access to the ad submission page for requests referencing payment transactions, particularly requests made by unauthenticated users.