{"id":"CVE-2025-15700","aliases":["EUVD-2025-211055","GHSA-vx4h-jmgv-fhcw"],"status":"published","title":"AWP Classifieds \u003c 4.4.9 - Admin+ Arbitrary File Upload via ZIP Import","description":"The AWP Classifieds WordPress plugin before 4.4.9 does not validate the type of files extracted from an uploaded ZIP archive during its listing-import feature, allowing users with the AWP Classifieds WordPress plugin before 4.4.9's management capability to upload arbitrary PHP files to a publicly accessible, network-shared directory and achieve remote code execution.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00394,"percentile":0.33942,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-434"],"published":"2026-10-09T06:00:08Z","modified":"2026-10-19T22:10:00Z","products":[{"vendor":"strategy11team","product":"awp classifieds"},{"vendor":"unknown","product":"awp classifieds"}],"references":[{"url":"https://wpscan.com/vulnerability/6d3e7721-41d4-4e5f-9a44-c601f0cdfe50/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-15700"},{"url":"https://wpscan.com/vulnerability/6d3e7721-41d4-4e5f-9a44-c601f0cdfe50"},{"url":"https://github.com/advisories/GHSA-vx4h-jmgv-fhcw"}],"sources":{"cve":[{"id":"CVE-2025-15700","title":"AWP Classifieds \u003c 4.4.9 - Admin+ Arbitrary File Upload via ZIP Import","description":"The AWP Classifieds WordPress plugin before 4.4.9 does not validate the type of files extracted from an uploaded ZIP archive during its listing-import feature, allowing users with the AWP Classifieds WordPress plugin before 4.4.9's management capability to upload arbitrary PHP files to a publicly accessible, network-shared directory and achieve remote code execution.","status":"published","published":"2026-10-09T06:00:08.476Z","modified":"2026-10-09T14:50:08.877Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:32:37.351404Z"}],"euvd":[{"id":"EUVD-2025-211055","description":"The AWP Classifieds WordPress plugin before 4.4.9 does not validate the type of files extracted from an uploaded ZIP archive during its listing-import feature, allowing users with the AWP Classifieds WordPress plugin before 4.4.9's management capability to upload arbitrary PHP files to a publicly accessible, network-shared directory and achieve remote code execution.","status":"published","published":"2026-10-09T06:00:08Z","modified":"2026-10-09T14:50:08Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T17:27:25.010362Z"}],"ghsa":[{"id":"GHSA-vx4h-jmgv-fhcw","title":"The AWP Classifieds WordPress plugin before 4.4.9 does not validate the type of files extracted...","description":"The AWP Classifieds WordPress plugin before 4.4.9 does not validate the type of files extracted from an uploaded ZIP archive during its listing-import feature, allowing users with the AWP Classifieds WordPress plugin before 4.4.9's management capability to upload arbitrary PHP files to a publicly accessible, network-shared directory and achieve remote code execution.","status":"published","published":"2026-10-09T09:31:03Z","modified":"2026-10-09T15:32:33Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T15:13:01.290603Z"}],"nvd":[{"id":"CVE-2025-15700","description":"The AWP Classifieds WordPress plugin before 4.4.9 does not validate the type of files extracted from an uploaded ZIP archive during its listing-import feature, allowing users with the AWP Classifieds WordPress plugin before 4.4.9's management capability to upload arbitrary PHP files to a publicly accessible, network-shared directory and achieve remote code execution.","status":"published","published":"2026-10-09T07:17:16.64Z","modified":"2026-10-19T22:10:00.13Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:12:03.20248Z"}]}}