CVE-2026-42726

Vulnerability

A missing authorization vulnerability exists in the Strategy11 Team AWP Classifieds plugin for WordPress (another-wordpress-classifieds-plugin) versions from n/a through 4.4.5 [1]. The plugin fails to properly enforce access control checks, allowing exploitation of incorrectly configured access control security levels. This broken access control issue enables unprivileged users to bypass authorization and perform higher-privileged actions [1].

Exploitation

An attacker can exploit this vulnerability without needing any special privileges or authentication, as the missing authorization check allows direct access to restricted functions or endpoints [1]. The attack is remotely exploitable over the network and does not require user interaction. The vulnerability is expected to be used in mass-exploit campaigns targeting thousands of websites [1].

Impact

Successful exploitation allows an unprivileged attacker to execute higher-privileged actions, potentially leading to unauthorized access, modification, or disclosure of sensitive data [1]. The vulnerability has a CVSS v3 score of 6.5 (Medium) [1].

Mitigation

The vulnerability is fixed in version 4.4.6 of the plugin [1]. Users are advised to update to version 4.4.6 or later immediately. If unable to update, users can ask their hosting provider or web developer for assistance, or use Patchstack's mitigation rules to block attacks until a patch is applied [1].