Attackers can send a web request to the ad submission page for any listing when a payment transaction is referenced, and the plugin fails to verify ownership or authentication. This allows the private contact e‑mail address associated with the listing to be exposed to the attacker. The weakness is a classic information‑disclosure flaw (CWE‑200), limiting the compromise to the confidentiality of the owned data.

WordPress sites using the AWP Classifieds plugin with version numbers earlier than 4.4.9 are affected. The vulnerability is present in all releases before the 4.4.9 update, regardless of other configuration settings.

The CVSS score of 5.3 classifies this as a medium‑severity vulnerability, and the EPSS score of less than 1% indicates a low probability of exploitation at this time. The issue is not listed in CISA’s KEV catalogue, suggesting no known active exploitation reports. Based on the description, the likely attack vector is an unauthenticated HTTP request to the ad placement page that includes a payment transaction reference. If the site requires a logged‑in user to view such emails, the plugin’s failure to enforce that check allows a remote actor to harvest private e‑mail addresses without authentication.