Based on the description, the vulnerability is a missing authorization flaw in the Strategy11 Team AWP Classifieds WordPress plugin. Attackers who can reach the plugin’s administrative interfaces can bypass normal access controls and perform unauthorized editing, deletion, or creation of classified listings. This compromise can lead to data tampering, integrity violations, and possible disclosure of user‑generated content. The weakness is identified as CWE‑862, indicating a failure to restrict privileged functions.

The flaw exists in all releases of the AWP Classifieds plugin up to and including version 4.4.5. Any WordPress site that has the plugin installed with that or an older version is potentially affected. Versions newer than 4.4.5 are not impacted.

The CVSS score of 6.5 denotes a moderate severity risk. The EPSS score is not available, so the exploitation probability is unknown. The vulnerability is not listed in the CISA KEV catalog, indicating no publicly verified exploits. Based on the description, it is inferred that attackers can exploit the flaw via the plugin’s web interface after authenticating or by leveraging misconfigured default access groups. When non‑admin users are granted administrative‑level privileges by the plugin, the risk is higher and could facilitate fraud or content sabotage.