CVE-2026-24593: AWP Classifieds Information Disclosure

CVE-2026-24593 Overview

CVE-2026-24593 is a sensitive data exposure vulnerability in the Strategy11 Team AWP Classifieds plugin (another-wordpress-classifieds-plugin) for WordPress. The flaw allows unauthenticated remote attackers to retrieve embedded sensitive system information from affected installations. The issue is classified under [CWE-497]: Exposure of Sensitive System Information to an Unauthorized Control Sphere. All plugin versions up to and including 4.4.3 are affected.

Critical Impact
An unauthenticated network attacker can retrieve embedded sensitive data from WordPress sites running vulnerable versions of the AWP Classifieds plugin, potentially exposing configuration details useful for further attacks.

Affected Products

Strategy11 Team AWP Classifieds (another-wordpress-classifieds-plugin)
All versions through 4.4.3
WordPress installations with the plugin enabled

Discovery Timeline

2026-01-23 - CVE CVE-2026-24593 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2026-24593

Vulnerability Analysis

The vulnerability stems from improper handling of sensitive system information within the AWP Classifieds plugin. The plugin exposes embedded data to requests originating outside the trusted control sphere. An attacker does not need authentication or user interaction to trigger the disclosure. The exposed information can include configuration values, internal paths, or other operational details that should remain restricted to administrators.

The plugin processes requests without adequately verifying the requester's authorization to access the underlying data. Because the attack vector is network-based and complexity is low, exploitation requires only standard HTTP requests against an affected WordPress site. The scope of disclosure is limited to confidentiality, with no direct impact on integrity or availability of the host.

Root Cause

The root cause is the absence of access controls around endpoints or routines that emit sensitive system information. The plugin treats requests as authorized to receive embedded data when they should be filtered or rejected. This mapping to [CWE-497] reflects a design oversight in how internal system data is surfaced through plugin functionality accessible to anonymous clients.

Attack Vector

An attacker sends crafted HTTP requests to a WordPress installation running AWP Classifieds versions through 4.4.3. The vulnerable handler returns embedded sensitive data in the response. The attacker can then use this disclosure to plan follow-on attacks such as targeting administrative endpoints or chaining against other plugin weaknesses. Refer to the Patchstack Vulnerability Report for technical specifics.

Detection Methods for CVE-2026-24593

Indicators of Compromise

Unauthenticated HTTP GET or POST requests to AWP Classifieds plugin endpoints originating from unfamiliar IP addresses.
Web server access logs showing repeated requests targeting another-wordpress-classifieds-plugin paths under /wp-content/plugins/.
Outbound HTTP responses containing internal configuration fields, file paths, or environment data to anonymous clients.

Detection Strategies

Inventory WordPress installations and identify any running AWP Classifieds at version 4.4.3 or earlier.
Review WordPress access logs for anonymous traffic targeting plugin-specific URLs and AJAX actions.
Correlate plugin request patterns with reconnaissance behavior such as enumeration of plugin endpoints across multiple sites.

Monitoring Recommendations

Enable verbose logging on the WordPress reverse proxy or web application firewall for plugin paths.
Alert on response payloads from plugin endpoints that contain sensitive keywords such as DB_, secret, or absolute filesystem paths.
Monitor for spikes in request volume against the AWP Classifieds plugin from single source IPs.

How to Mitigate CVE-2026-24593

Immediate Actions Required

Identify all WordPress sites running AWP Classifieds at version 4.4.3 or below and prioritize remediation.
Apply the vendor patch as soon as it is published by Strategy11 Team.
Restrict access to plugin endpoints at the web application firewall until patching is complete.

Patch Information

At the time of publication, the vulnerability affects AWP Classifieds versions up to and including 4.4.3. Administrators should consult the Patchstack Vulnerability Report and the vendor's plugin page on the WordPress plugin repository for the fixed release once available.

Workarounds

Disable the AWP Classifieds plugin until a patched version is installed.
Block anonymous access to plugin-specific URLs using a web application firewall rule.
Restrict plugin endpoints to authenticated users via server-level access controls where feasible.

bash

# Example WAF rule to block anonymous access to AWP Classifieds endpoints
location ~* /wp-content/plugins/another-wordpress-classifieds-plugin/ {
    deny all;
    return 403;
}