CVE-2022-3254: AWP Classifieds Plugin < 4.3 - Unauthenticated SQLi

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 5.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-10-31 · updated 2026-06-17
Weakness: CWE-89

Description

The WordPress Classifieds Plugin WordPress plugin before 4.3 does not properly sanitise and escape some parameters before using them in a SQL statement via an AJAX action available to unauthenticated users and when a specific premium module is active, leading to a SQL injection

Affected products

AWP Classifieds Team AWP Classifieds: before 4.3 — fixed in 4.3

How to fix

Upgrade to a fixed version: AWP Classifieds Team AWP Classifieds 4.3. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/546c47c2-5b4b-46db-b754-c6b43aef2660
https://wpscan.com/vulnerability/546c47c2-5b4b-46db-b754-c6b43aef2660

Get alerted when CVE-2022-3254 or the next vulnerability affects your stack