CVE-2026-24593
BaseFortify
Publication date: 2026-01-23
Last updated on: 2026-01-26
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| strategy11 | another_wordpress_classifieds_plugin | to 4.4.3 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-497 | The product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided resources do not specify how this vulnerability affects compliance with common standards and regulations such as GDPR or HIPAA.
Can you explain this vulnerability to me?
CVE-2026-24593 is a Sensitive Data Exposure vulnerability in the WordPress AWP Classifieds Plugin (versions up to 4.4.3). It allows unauthenticated attackers to access sensitive system information that should normally be restricted. This exposure could potentially be used to exploit other system weaknesses, but the overall severity is considered low. [1]
How can this vulnerability impact me? :
This vulnerability can allow unauthorized users to retrieve sensitive information from the system without any privileges. While the direct impact is limited and rated as low severity, the exposed data could be leveraged to carry out further attacks or exploit other vulnerabilities within the system. [1]
What immediate steps should I take to mitigate this vulnerability?
Since no official fix or patched version is available as of the publication date, immediate mitigation steps include using Patchstack's mitigation services if possible, restricting access to the affected plugin or site areas to trusted users only, and monitoring for any unauthorized access attempts. Additionally, consider disabling or removing the AWP Classifieds plugin until a patch is released to prevent exploitation by unauthenticated attackers. [1]