CVE-2025-15700CWE-434unrestricted-file-upload

CVE-2025-15700

High · published October 9, 2026

CVSS v3.1
8.8
EPSS
0%
Percentile
33.7
In the wild
Unconfirmed
What it is

The AWP Classifieds WordPress plugin before 4.4.9 does not validate the type of files extracted from an uploaded ZIP archive during its listing-import feature, allowing users with the AWP Classifieds WordPress plugin before 4.4.9's management capability to upload arbitrary PHP files to a publicly accessible, network-shared directory and achieve remote code execution.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00406 · 33.7th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2026-10-09T11:17Z
References (1)
https://wpscan.com/vulnerability/6d3e7721-41d4-4e5f-9a44-c601f0cdfe50/ · [email protected]
EPSS history
Timeline
  • 10 OCT 03:24Z
    EPSS moved — → 0%
    epss
  • 09 OCT 06:00Z
    AWP Classifieds < 4.4.9 - Admin+ Arbitrary File Upload via ZIP Import
    cvelistv5
  • 09 OCT 06:00Z
    AWP Classifieds < 4.4.9 - Admin+ Arbitrary File Upload via ZIP Import
    cvelistv5