The AWP Classifieds plugin for WordPress is affected by a critical unauthenticated SQL injection vulnerability that allows remote attackers to compromise backend database integrity.

This is a classic SQL injection flaw (CWE-89) where the application fails to properly sanitize user-supplied input before using it in database queries. Because the vulnerability is unauthenticated, any remote attacker can interact with the plugin without requiring a login or administrative session.

Successful exploitation of this vulnerability can result in the full exposure of sensitive database contents, including user credentials, personal information, or configuration data. Given the CVSS score of 9.3, this flaw poses a severe risk to data confidentiality and application integrity, necessitating immediate attention to prevent unauthorized data exfiltration.

Immediate Action: Update the WordPress AWP Classifieds plugin to version 4.4.8 or later immediately to resolve the vulnerable code path.

Proactive Monitoring: Review web server and database logs for anomalous query strings or patterns that include SQL syntax characters, such as single quotes or UNION statements.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting WordPress plugins.

Public Exploit Available: Unknown

This vulnerability represents a critical risk to any site hosting the AWP Classifieds plugin. Administrators should prioritize updating to version 4.4.8 without delay, as the lack of authentication requirements makes this an ideal target for automated exploitation campaigns.