Technical impact
The vulnerability in Strategy11 Team AWP Classifieds allows an attacker to retrieve embedded sensitive data from a WordPress site. This results in unauthorized disclosure of system information that should be protected, potentially revealing user data, configuration details, and other confidential information. The weakness is rooted in improper handling of data retrieval, leading to direct exposure of sensitive data to an unauthorized control sphere.
Affected Systems
Affected systems include the WordPress AWP Classifieds plugin distributed by Strategy11 Team. The flaw exists in all versions up through 4.4.3, including any deployment that has not been upgraded beyond that release.
Risk and Exploitability
The CVSS score of 5.3 indicates a moderate risk, and the EPSS score of less than 1% suggests that exploitation is uncommon at this time. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is an unauthenticated web request that accesses a plugin endpoint exposing sensitive data. The impact is limited to confidentiality, with no evidence of remote code execution or denial of service in the provided data.
