The AWP Classifieds plugin for WordPress is vulnerable to SQL Injection via the 'regions' parameter array…

CVE-2026-5100 is an *unauthenticated* SQL injection in the WordPress plugin AWP Classifieds. The vulnerable input is the regions parameter *array keys*, which means an attacker does not need a login if they can reach a page that exercises the plugin’s region-filtering logic. The CNA/NVD description says versions up to and including 4.4.5 are affected, but multiple downstream sources and the plugin changelog point to 4.4.6.1 as the first clearly fixed release, so the safe defender assumption is that anything below 4.4.6.1 is exposed.

Vendor severity at 7.5/HIGH is basically fair. The amplifier is obvious: this is pre-auth web exploitation against a typically internet-facing CMS. The downward pressure is also obvious: the plugin has only about 3,000 active installs, there is no KEV listing, the provided EPSS is 0.00199, and the likely impact is database disclosure rather than turnkey server takeover. For a fleet operator, this is a sharp but *niche* edge: patchable, important, and worth real attention, just not a panic-grade ecosystem event.

Why this verdict

• Baseline stays high: vendor 7.5 fits the core fact pattern — remote, unauthenticated SQLi against a public web app path.
• Downward adjustment for exposure population: the plugin is only about 3,000 active installs, so this is not a broad WordPress ecosystem event.
• Downward adjustment for threat intel: no KEV listing, no reviewed public exploitation evidence, and EPSS 0.00199 argue against elevating to CRITICAL.
• Downward adjustment for blast radius: the modeled impact is mainly database disclosure on the affected site or tenant, not immediate RCE across the host estate.
• No bigger downgrade because attacker position is still ideal: this does not require prior compromise, internal access, authentication, or a privileged role.

Why not higher?

CRITICAL needs either a wider exposed population, stronger field-exploitation evidence, or a more direct path to full server compromise. Here, the product is niche, the public threat signals are weak, and the likely first-order impact is data theft from a specific WordPress instance.

Why not lower?

This is still pre-auth web exploitation against software that is commonly deployed on public websites. A low- or medium-severity rating would understate the risk because the attacker does not need credentials, user interaction, or internal foothold to start pulling data.

1. Upgrade to 4.4.6.1 or later — Apply the vendor fix on every site running another-wordpress-classifieds-plugin. For a HIGH verdict, complete this within 30 days if no faster business process applies; given the source mismatch on the upper affected version, do not stop at 4.4.6.
2. Virtual-patch the regions parameter — Deploy a WAF or managed WordPress firewall rule that blocks suspicious regions[...] key manipulation and common SQLi metacharacters on classifieds/search routes. Use this as immediate exposure reduction and have it in place within 30 days if patching lags.
3. Restrict public reach to classifieds endpoints — If the business can tolerate it, temporarily geo-fence, IP-allowlist, or disable the vulnerable classifieds/search pages that process region filters. This is especially useful for low-traffic internal or partner-facing sites and should be done within 30 days where patching cannot be immediate.
4. Review for compromise indicators — Search web logs, WAF logs, and database access anomalies for requests containing nested regions parameters, quote characters, boolean conditions, or timing-probe patterns. Do this now to separate 'just exposed' from 'already touched' before the 30-day remediation window closes.

Run this on the target WordPress host or in the container/VM that holds the site files. Invoke it as bash verify-awp-classifieds-cve-2026-5100.sh /var/www/html or point it directly at the plugin directory; it only needs read access to the plugin files, not root.

#!/usr/bin/env bash
# verify-awp-classifieds-cve-2026-5100.sh
# Checks whether the installed AWP Classifieds plugin version is vulnerable to CVE-2026-5100.
# Conservative logic: treat versions < 4.4.6.1 as VULNERABLE due to source disagreement.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

TARGET="${1:-.}"
PLUGIN_DIR=""
PLUGIN_MAIN=""
VERSION=""

find_plugin_dir() {
  local base="$1"
  if [ -d "$base/wp-content/plugins/another-wordpress-classifieds-plugin" ]; then
    echo "$base/wp-content/plugins/another-wordpress-classifieds-plugin"
    return 0
  fi
  if [ -d "$base/another-wordpress-classifieds-plugin" ]; then
    echo "$base/another-wordpress-classifieds-plugin"
    return 0
  fi
  if [ -d "$base" ] && [ -f "$base/awpcp.php" ]; then
    echo "$base"
    return 0
  fi
  return 1
}

version_lt() {
  # returns 0 if $1 < $2
  [ "$(printf '%s\n%s\n' "$1" "$2" | sort -V | head -n1)" != "$2" ]
}

extract_version() {
  local dir="$1"
  local main="$dir/awpcp.php"
  local readme="$dir/readme.txt"
  local v=""

  if [ -f "$main" ]; then
    v=$(grep -Eim1 '^[[:space:]]*Version:[[:space:]]*[0-9]+([.][0-9A-Za-z-]+)*' "$main" | sed -E 's/^[[:space:]]*Version:[[:space:]]*//I' | tr -d '\r')
    if [ -n "$v" ]; then
      echo "$v"
      return 0
    fi
  fi

  if [ -f "$readme" ]; then
    v=$(grep -Eim1 '^[[:space:]]*Stable tag:[[:space:]]*[0-9]+([.][0-9A-Za-z-]+)*' "$readme" | sed -E 's/^[[:space:]]*Stable tag:[[:space:]]*//I' | tr -d '\r')
    if [ -n "$v" ]; then
      echo "$v"
      return 0
    fi
  fi

  return 1
}

if ! PLUGIN_DIR=$(find_plugin_dir "$TARGET"); then
  echo "UNKNOWN - AWP Classifieds plugin directory not found from target: $TARGET"
  exit 2
fi

PLUGIN_MAIN="$PLUGIN_DIR/awpcp.php"

if ! VERSION=$(extract_version "$PLUGIN_DIR"); then
  echo "UNKNOWN - Could not determine installed plugin version in: $PLUGIN_DIR"
  exit 2
fi

PATCH_FLOOR="4.4.6.1"

if version_lt "$VERSION" "$PATCH_FLOOR"; then
  echo "VULNERABLE - AWP Classifieds version $VERSION is below patched floor $PATCH_FLOOR (CVE-2026-5100)"
  exit 1
else
  echo "PATCHED - AWP Classifieds version $VERSION is at or above $PATCH_FLOOR"
  exit 0
fi

Sources

1. NVD CVE-2026-5100
2. Wordfence vulnerability entry
3. Wordfence plugin overview
4. WordPress.org plugin page and changelog
5. Patchstack advisory
6. WPScan plugin vulnerability listing
7. FIRST EPSS API documentation
8. CISA Known Exploited Vulnerabilities Catalog