CVE-2026-5100: AWP Classifieds Plugin SQLi Vulnerability

CVE-2026-5100 Overview

CVE-2026-5100 is an unauthenticated SQL Injection vulnerability in the AWP Classifieds plugin (also known as Another WordPress Classifieds Plugin) for WordPress. The flaw affects all versions up to and including 4.4.5. The plugin fails to properly escape array keys passed through the regions parameter and does not adequately prepare the underlying SQL statement. Attackers can append arbitrary SQL to existing queries to extract sensitive data from the WordPress database, including user credentials and configuration secrets. The vulnerability is classified under CWE-89: Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact
Unauthenticated remote attackers can extract sensitive database contents from any WordPress site running AWP Classifieds 4.4.5 or earlier without requiring authentication or user interaction.

Affected Products

AWP Classifieds plugin for WordPress (Another WordPress Classifieds Plugin)
All versions up to and including 4.4.5
WordPress sites with the plugin enabled and search functionality exposed

Discovery Timeline

2026-05-05 - CVE-2026-5100 published to NVD
2026-05-05 - Last updated in NVD database

Technical Details for CVE-2026-5100

Vulnerability Analysis

The vulnerability resides in how AWP Classifieds processes the regions request parameter when filtering classifieds listings. User-supplied input is passed as an associative array, and the array keys are concatenated into an SQL query without sanitization or parameterization. Because the keys themselves are user-controlled, escaping the values alone provides no protection.

Attackers can trigger the flaw through the public listing search endpoint without authentication. By crafting regions[<payload>] keys, an attacker injects additional SQL clauses such as UNION SELECT statements that exfiltrate data from arbitrary tables. The injection point sits in the search and query integration code paths referenced in frontend/page-search-ads.php and includes/listings/class-query-integration.php.

Root Cause

The root cause is insufficient escaping of array keys combined with the absence of wpdb::prepare() parameterization on the constructed SQL query. WordPress developers commonly sanitize values within $_GET or $_POST arrays but overlook keys, which the AWP Classifieds plugin interpolated directly into SQL strings. The affected logic appears in multiple files including functions.php and class-query-integration.php as documented in the Wordfence Vulnerability Report.

Attack Vector

Exploitation occurs over the network against the WordPress front-end search functionality. An unauthenticated attacker submits an HTTP GET or POST request to a search endpoint with a malicious regions parameter where the array keys contain SQL syntax. The injected SQL executes within the database query context, enabling time-based or UNION-based extraction of sensitive records such as the wp_users table. See the WordPress Plugin Code Review at line 795 for the vulnerable query construction.

No authenticated session, CSRF token, or user interaction is required. The vulnerability has not been observed in active exploitation and is not listed in the CISA Known Exploited Vulnerabilities catalog at this time.

Detection Methods for CVE-2026-5100

Indicators of Compromise

HTTP requests containing regions[ parameter with SQL keywords such as UNION, SELECT, SLEEP, or BENCHMARK in the array key portion
Anomalous database query latency on WordPress sites running AWP Classifieds, indicating potential time-based blind injection
Web server access logs showing repeated requests to page-search-ads.php or classifieds search URLs from a single source IP
Unexpected outbound connections from the web server following malformed regions parameter requests

Detection Strategies

Inspect web access logs for regions%5B (URL-encoded regions[) parameters containing SQL metacharacters such as single quotes, parentheses, or comment sequences (--, /*)
Deploy a Web Application Firewall (WAF) rule that blocks requests where array keys for the regions parameter contain non-alphanumeric characters
Monitor MySQL slow query logs for unexpectedly long-running queries originating from AWP Classifieds search operations
Correlate failed authentication attempts on WordPress admin accounts following suspicious regions parameter activity, which may indicate credential extraction followed by login attempts

Monitoring Recommendations

Enable verbose request logging on the WordPress front-end and ship logs to a centralized SIEM for retroactive hunting
Alert on any HTTP request body or query string exceeding typical length thresholds for the AWP Classifieds search endpoint
Track database read volume baselines and alert on spikes that coincide with classifieds search traffic
Review WordPress plugin inventories regularly to identify outdated AWP Classifieds installations across managed estates

How to Mitigate CVE-2026-5100

Immediate Actions Required

Upgrade AWP Classifieds plugin to a version newer than 4.4.5 as soon as the vendor publishes a patched release
Audit the WordPress database for unauthorized read access by reviewing recent query logs and user account modifications
Rotate WordPress administrator passwords and any API keys or secrets stored in the wp_options table if exploitation is suspected
Restrict access to the classifieds search functionality at the WAF layer until patching is complete

Patch Information

At the time of publication, the vulnerability affects versions through 4.4.5. Administrators should monitor the official plugin repository and the Wordfence advisory for the patched release. The fix should replace direct array key interpolation with wpdb::prepare() calls and validate region identifiers against an allowlist.

Workarounds

Disable the AWP Classifieds plugin until a patched version is installed if classifieds functionality is non-essential
Deploy a WAF rule that rejects requests where any array key under the regions parameter contains characters outside [A-Za-z0-9_-]
Restrict access to the classifieds search pages to authenticated users via .htaccess or WordPress access control plugins as a temporary control
Apply database-level least privilege so the WordPress MySQL user cannot read tables outside the WordPress schema

bash

# Example ModSecurity rule blocking SQLi in regions[] keys
SecRule ARGS_NAMES "@rx ^regions\[[^]]*(?:union|select|sleep|benchmark|--|/\*)" \
    "id:1026510,phase:2,deny,status:403,log,\
    msg:'CVE-2026-5100 AWP Classifieds SQLi attempt in regions[] key'"