CVE-2026-42726 Overview
CVE-2026-42726 is a Missing Authorization vulnerability [CWE-862] in the Strategy11 Team another-wordpress-classifieds-plugin (AWP Classifieds) for WordPress. The flaw stems from incorrectly configured access control security levels, allowing unauthenticated network attackers to reach functionality that should require authorization. The issue affects all versions up to and including 4.4.5. Exploitation does not require user interaction or privileges, and produces limited integrity and availability impact on the WordPress site. Site operators running classified-listing functionality on public-facing WordPress instances are within scope.
Critical Impact
Unauthenticated attackers can invoke restricted plugin actions over the network, leading to limited modification of data and degraded availability on affected WordPress sites.
Affected Products
- Strategy11 Team AWP Classifieds (another-wordpress-classifieds-plugin) — versions through 4.4.5
- WordPress installations with the AWP Classifieds plugin enabled
- Sites exposing plugin endpoints to unauthenticated network traffic
Discovery Timeline
- 2026-05-27 - CVE-2026-42726 published to NVD
- 2026-05-27 - Last updated in NVD database
Technical Details for CVE-2026-42726
Vulnerability Analysis
The vulnerability is a broken access control issue in the AWP Classifieds WordPress plugin. The plugin exposes one or more action handlers that fail to verify the caller's authorization before executing privileged operations. Because the checks for capability or role membership are absent or misconfigured, requests originating from unauthenticated sources reach code paths intended for authenticated or higher-privileged users.
The attack surface is reachable over the network with low attack complexity. An attacker can craft HTTP requests targeting the vulnerable plugin endpoints and receive the same outcome a privileged user would. The exploit prediction probability remains low at the time of publication, and no public proof-of-concept or in-the-wild exploitation has been confirmed.
Root Cause
The root cause is a missing authorization check [CWE-862] in the plugin's request-handling logic. The affected handlers do not call WordPress capability functions such as current_user_can() or validate nonces consistently before executing state-changing operations. As a result, access control security levels are enforced inconsistently across the plugin's action surface.
Attack Vector
The attack vector is network-based. An unauthenticated attacker sends HTTP requests directly to the WordPress site, targeting plugin actions exposed via admin-ajax.php, REST routes, or front-controller hooks registered by the plugin. No user interaction is required. Successful requests permit limited integrity changes and minor availability impact on plugin-managed data, such as classified listings or related metadata. See the Patchstack Vulnerability Report for additional technical context.
Detection Methods for CVE-2026-42726
Indicators of Compromise
- Unauthenticated POST requests to admin-ajax.php containing AWP Classifieds action parameters such as awpcp_*.
- Unexpected modifications, additions, or deletions in classified-listing tables created by the plugin.
- HTTP 200 responses to plugin action endpoints from clients lacking valid authentication cookies.
Detection Strategies
- Inspect web server access logs for requests to AWP Classifieds endpoints originating from anonymous sessions or unusual user agents.
- Audit WordPress database tables managed by the plugin for entries created or altered without a corresponding authenticated user ID.
- Compare installed plugin versions against the fixed release across the WordPress estate using a plugin inventory query.
Monitoring Recommendations
- Forward WordPress and web server logs to a centralized logging platform and alert on spikes in plugin action requests.
- Monitor file integrity for the another-wordpress-classifieds-plugin directory under wp-content/plugins/.
- Track outbound requests from the WordPress host that follow plugin endpoint hits to identify chained abuse.
How to Mitigate CVE-2026-42726
Immediate Actions Required
- Update the AWP Classifieds plugin to a release later than 4.4.5 as soon as the vendor publishes a fixed version.
- If no patched version is available, disable and remove the plugin from production WordPress instances.
- Restrict access to wp-admin/admin-ajax.php and plugin REST routes using a Web Application Firewall (WAF) rule limited to authenticated sessions where feasible.
Patch Information
Review the Patchstack Vulnerability Report for the current vendor patch status. All versions up to and including 4.4.5 are affected; administrators should upgrade to the first vendor-released version that addresses the missing authorization check.
Workarounds
- Deploy WAF signatures that block unauthenticated requests to AWP Classifieds action handlers.
- Place the WordPress administration surface behind an IP allowlist or VPN until the plugin is patched.
- Temporarily deactivate the plugin if classified-listing functionality is not business-critical.
# Configuration example: list and disable the affected plugin via WP-CLI
wp plugin list --name=another-wordpress-classifieds-plugin --fields=name,status,version
wp plugin deactivate another-wordpress-classifieds-plugin
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
