CVE-2025-15700

Name of the Vulnerable Software and Affected Versions AWP Classifieds WordPress plugin versions prior to 4.4.9

Description The listing-import feature fails to validate the file types extracted from uploaded ZIP archives. This allows users with management capabilities to upload arbitrary PHP files to a publicly accessible, network-shared directory, which can lead to remote code execution (RCE), a process where an attacker executes malicious commands on the host machine.

Recommendations Update AWP Classifieds WordPress plugin to version 4.4.9 or later.