AWP Classifieds Plugin SQLi Exposes WordPress Sites
The National Vulnerability Database has disclosed CVE-2026-5100, a high-severity SQL Injection vulnerability affecting the AWP Classifieds plugin for WordPress. Versions up to and including 4.4.5 are susceptible. The flaw stems from insufficient escaping of user-supplied parameters within the ‘regions’ array keys and inadequate preparation of existing SQL queries.
This critical vulnerability allows unauthenticated attackers to inject malicious SQL queries, enabling them to extract sensitive information directly from the database. A CVSSv3.1 score of 7.5 (High) highlights the ease of exploitation, requiring no authentication or user interaction (AV:N/AC:L/PR:N/UI:N).
For defenders, this is a clear call to action. WordPress sites utilizing the AWP Classifieds plugin are at immediate risk. Exploitation is trivial for anyone with basic SQLi knowledge. The attacker’s calculus here is simple: find vulnerable sites, automate the data exfiltration, and move on. This isn’t about sophisticated nation-state attacks; it’s about low-hanging fruit for opportunistic attackers.
What This Means For You
- If your organization uses the AWP Classifieds plugin for WordPress, you are exposed to unauthenticated SQL injection. Prioritize patching to a version beyond 4.4.5 immediately. Audit your WordPress database logs for any suspicious queries or data exfiltration attempts.
Related ATT&CK Techniques
🛡️ Detection Rules
3 rules · 6 SIEM formats3 detection rules auto-generated for this incident, mapped to MITRE ATT&CK. Sigma YAML is free — export to any SIEM format via the Intel Bot.
CVE-2026-5100 - AWP Classifieds SQL Injection Attempt
title: CVE-2026-5100 - AWP Classifieds SQL Injection Attempt
id: scw-2026-05-05-ai-1
status: experimental
level: critical
description: |
Detects attempts to exploit CVE-2026-5100 by looking for the specific 'regions' parameter in the query string, commonly used in SQL injection attacks against the AWP Classifieds plugin. This rule targets unauthenticated GET requests that return a successful response, indicating a potential data exfiltration attempt.
author: SCW Feed Engine (AI-generated)
date: 2026-05-05
references:
- https://shimiscyberworld.com/posts/nvd-CVE-2026-5100/
tags:
- attack.initial_access
- attack.t1190
logsource:
category: webserver
detection:
selection:
cs-uri-query|contains:
- 'regions%5B'
cs-method:
- 'GET'
sc-status:
- '200'
condition: selection
falsepositives:
- Legitimate administrative activity
Source: Shimi's Cyber World · License & reuse
Indicators of Compromise
| ID | Type | Indicator |
|---|---|---|
| CVE-2026-5100 | SQLi | AWP Classifieds plugin for WordPress |
| CVE-2026-5100 | SQLi | Versions up to and including 4.4.5 |
| CVE-2026-5100 | SQLi | Vulnerable parameter: 'regions' (array keys) |
| CVE-2026-5100 | SQLi | CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') |
Written by SCW Vulnerability Desk
Source & Attribution
| Source Platform | NVD |
| Channel | National Vulnerability Database |
| Published | May 05, 2026 at 06:15 UTC |
This content was AI-rewritten and enriched by Shimi's Cyber World based on the original source. All intellectual property rights remain with the original author.
Believe this infringes your rights? Submit a takedown request.
Related coverage
CVE-2026-7810: Python Notebook Path Traversal Exposes Servers
CVE-2026-7810 — A flaw has been found in UsamaK98 python-notebook-mcp up to a05a232815809a7e425b5fa7be26e0d4369894c2. Impacted is the function create_notebook/read_notebook/edit_cell/add_cell of the file server.py. This manipulation causes...
CVE-2026-5957 — Path Traversal
CVE-2026-5957 — The EmailKit plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to and including 1.6.5. This is due to...
CVE-2026-5294: Critical RCE in Geeky Bot WordPress Plugin
CVE-2026-5294 — The Geeky Bot plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.2.2. This is due to a...