CVE-2026-96904— AWP Classifieds < 4.4.9 - Unauthenticated Listing Contact Email Disclosure via Place Ad Page
Quick assessment
Affected
Unknown AWP Classifieds
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 4.4.9 版本之前，AWP Classifieds WordPress 插件在引用支付交易时，未验证请求是否有权查看某一商品列表，从而导致未经身份验证的攻击者可以绕过广告提交页面的所有权检查，并读取存储在任何商品列表中的私有联系邮箱。
Affected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Unknown | AWP Classifieds | < 4.4.9 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-96904
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
AWP Classifieds < 4.4.9 - Unauthenticated Listing Contact Email Disclosure via Place Ad Page
Source: CVE Program / CVE List V5
Vulnerability Description
The AWP Classifieds WordPress plugin before 4.4.9 does not verify that a request is authorised to view a listing when a payment transaction is referenced, allowing unauthenticated attackers to bypass the ownership check on the ad submission page and read the private contact email stored on any listing.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | AWP Classifieds | 0 ~ 4.4.9 | - |
|
II. Public POCs for CVE-2026-96904
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-96904
请登录查看更多情报信息。
Same Patch Batch · Unknown · 2026-10-14 · 47 CVEs total
| CVE-2026-103308 | 6.5 MEDIUM | Visma Pay for WooCommerce < 1.2.2 - Unauthenticated Payment Bypass and Order Data Disclosu |
| CVE-2026-97315 | 5.4 MEDIUM | Responsive Blocks < 2.3.0 - Unauthenticated HTML Injection in Form Notification Email |
| CVE-2026-88998 | 5.3 MEDIUM | Tickera < 3.6.0.4 - Unauthenticated Order Payment Bypass via 2Checkout IPN |
| CVE-2026-82844 | 5.3 MEDIUM | WPForms Lite 1.10.0.1 - 2.0.2.1 - Unauthenticated Payment Bypass via PayPal Commerce |
| CVE-2026-101301 | 5.3 MEDIUM | WPCode 2.0.0 - 2.3.9 - Unauthenticated Snippet Suppression via Safe Mode Bypass |
| CVE-2026-104751 | Rank Math SEO < 1.0.280 - Unauthenticated SEO Analyzer Results Deletion | |
| CVE-2026-108066 | WP 2FA < 4.2.0 - Admin+ Arbitrary User 2FA Removal via IDOR | |
| CVE-2026-106166 | NEX-Forms 9.2.1 - 9.2.5 - Unauthenticated Arbitrary Form Entry Modification via 'nf_set_en | |
| CVE-2026-103307 | Walletdoc Payment Gateway for WooCommerce < 1.8.5 - Unauthenticated SQLi and Order Payment | |
| CVE-2026-106098 | WP Data Access < 5.5.77 - Unauthenticated Incorrect Authorization via Inline App Update | |
| CVE-2026-105261 | PublishPress Future 4.10.1 - 4.10.5 - Contributor+ Stored XSS via 'wrapper' and 'dateforma | |
| CVE-2026-107126 | WP Booking System < 2.1.0.1 - Unauthenticated Stored XSS via X-Forwarded-For Header | |
| CVE-2026-107178 | Image Photo Gallery Final Tiles Grid < 3.6.16 - Contributor+ Stored XSS via 'lightboxOptio | |
| CVE-2026-107160 | LTL Freight Quotes – Old Dominion Edition < 4.2.19 - Unauthenticated Stored HTML Injection | |
| CVE-2026-107158 | LTL Freight Quotes – Old Dominion Edition < 4.2.19 - Unauthenticated FreightDesk Integrati | |
| CVE-2026-106646 | Classified Listing < 6.1.1 - Subscriber+ Unattached Media Deletion and Modification via Ga | |
| CVE-2026-107320 | GamiPress 7.9.5 - 8.0.5 - Unauthenticated Private Activity Log Disclosure | |
| CVE-2026-107508 | Ultimate Multisite < 2.17.2 - Unauthenticated LFI via 'attributes' Parameter | |
| CVE-2026-107594 | File Upload to Order < 1.1.4 - Unauthenticated Arbitrary File Deletion | |
| CVE-2026-104644 | Image Photo Gallery Final Tiles Grid < 3.6.15 - Contributor+ Stored XSS via Gallery Config |
Showing top 20 of 47 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: AWP Classifieds
-
CVE-2025-15700
AWP Classifieds < 4.4.9 - Admin+ Arbitrary File Upload via Z -
CVE-2026-59550
WordPress AWP Classifieds plugin <= 4.4.7 - SQL Injection vu -
CVE-2026-65469
WordPress AWP Classifieds plugin <= 4.4.7 - Broken Access Co -
CVE-2026-39533
WordPress AWP Classifieds plugin <= 4.4.4 - Broken Access Co -
CVE-2026-42726
WordPress AWP Classifieds plugin <= 4.4.5 - Broken Access Co
Same vendor: Unknown
-
CVE-2026-110527
WP User Manager 2.9 - 2.9.19 - Unauthenticated Account Creat -
CVE-2026-97314
ThirstyAffiliates < 3.12.1 - Unauthenticated Non-Public Affi -
CVE-2026-81344
Frontend Admin by DynamiApps <= 3.29.13 - Admin+ PHP Object -
CVE-2026-81343
Frontend Admin by DynamiApps <= 3.29.13 - Unauthenticated AC -
CVE-2026-106470
WP Data Access < 5.5.88 - Subscriber+ SSRF
V. Comments for CVE-2026-96904
No comments yet