CVE-2025-15700
Received Received - Intake

Arbitrary File Upload in AWP Classifieds WordPress Plugin

Publication date: 2026-10-09

Last updated on: 2026-10-09

Assigner: WPScan

Description
The AWP Classifieds WordPress plugin before 4.4.9 does not validate the type of files extracted from an uploaded ZIP archive during its listing-import feature, allowing users with the AWP Classifieds WordPress plugin before 4.4.9's management capability to upload arbitrary PHP files to a publicly accessible, network-shared directory and achieve remote code execution.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-09
Last Modified
2026-10-09
Generated
2026-10-09
AI Q&A
2026-10-09
EPSS Evaluated
N/A
NVD
CVE-2025-15700
EUVD
EUVD-2025-211055

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown AWP Classifieds 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The AWP Classifieds WordPress plugin before version 4.4.9 has a flaw in its listing-import feature. When users with management capabilities upload a ZIP archive, the plugin does not check the file types being extracted. This allows attackers to upload malicious PHP files to a publicly accessible directory on the server.

Detection Guidance

Check if the AWP Classifieds WordPress plugin version is below 4.4.9. Inspect uploaded ZIP archives for unexpected PHP files in public directories. Review server logs for unusual file uploads or PHP execution attempts.

Impact Analysis

If exploited, this vulnerability enables remote code execution. Attackers could run arbitrary code on your server, potentially taking control of your website, stealing data, or using your server for malicious activities.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements like GDPR or HIPAA. Data breaches resulting from such vulnerabilities may lead to legal penalties, fines, or reputational damage.

Mitigation Strategies

Update the AWP Classifieds plugin to version 4.4.9 or later immediately. Remove any unauthorized PHP files from public directories. Restrict file upload permissions to trusted users only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-15700. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart