CVE-2025-15700

Summary

The AWP Classifieds WordPress plugin allows users with management capabilities to upload arbitrary PHP files via a ZIP archive import feature without validating file types, enabling remote code execution on the server. This vulnerability affects versions before 4.4.9 and can be exploited by authenticated users to gain full control over the affected WordPress installation.

Exploitability

Exploitation is relatively straightforward for authenticated users with AWP Classifieds management privileges, requiring only a ZIP file upload with malicious PHP code and subsequent access to the publicly accessible directory where files are extracted.

Blast radius

The impact could be significant as attackers could execute arbitrary code on the WordPress server, potentially leading to complete compromise of the site, data exfiltration, or use as a launchpad for further attacks within the network.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 4.4.9 or later to remediate this vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.