The AWP Classifieds WordPress plugin fails to validate the file types that are extracted from an uploaded ZIP archive during its listing‑import feature. Users with the plugin’s management capability can therefore upload arbitrary PHP files, placing them in a publicly accessible, network‑shared directory. Once the files are written, they can be executed by anyone who can request the URL, giving the attacker full control over the web server. This flaw leads directly to remote code execution and is therefore a high‑impact vulnerability.

WordPress sites that use the AWP Classifieds plugin in any version prior to 4.4.9 are affected. The vulnerability exists in the listing‑import functionality provided by this plugin, which can be accessed by administrators or any user with the plugin’s management permissions.

To exploit the flaw, an attacker must have authorization to use the listing‑import feature, typically requiring administrator or plugin‑management privileges. After uploading a malicious ZIP, the attacker can execute the embedded PHP script. The CVSS score is 8.8, and the EPSS score is < 1%. The vulnerability is not listed in CISA’s KEV catalog, but because it enables remote code execution through a trusted user feature, it should be treated with high priority.