The AWP Classifieds WordPress plugin (strategy11team:AWP Classifieds) is affected by a vulnerability that allows unauthenticated attackers to inject arbitrary SQL through the 'regions' parameter array keys. Because the code fails to escape user input and does not prepare the query properly, malicious requests can cause the plugin to concatenate additional SQL statements into the existing SELECT queries. An attacker could therefore read or modify database contents, leading to confidentiality or integrity compromise.

All installations of the AWP Classifieds plugin up to and including version 4.4.5 are vulnerable. The vulnerability is present in the plugin’s core files and list‑query integration, which are used by sites running this plugin. Majority of WordPress sites that have not yet upgraded beyond 4.4.5 remain exposed.

The plugin’s CVSS score of 7.5 reflects a high severity remote exploitation risk. EPSS data is not available, so the precise likelihood of exploitation cannot be quantified, but the lack of authentication requirements makes the attack vector straightforward: a crafted HTTP request containing the 'regions' parameter is sufficient. The vulnerability is not listed in CISA’s KEV catalog, yet its critical nature warrants immediate action.