What is GHSA-c67v-qmm6-33w7?

GHSA-c67v-qmm6-33w7 is a security advisory published by GitHub Security Advisories with Medium severity. The AWP Classifieds WordPress plugin before 4.4.9 does not verify that a request is authorised to...

Which CVE IDs does GHSA-c67v-qmm6-33w7 cover?

GHSA-c67v-qmm6-33w7 covers the following CVE IDs: CVE-2026-96904. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-c67v-qmm6-33w7?

GHSA-c67v-qmm6-33w7 has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

GHSA-c67v-qmm6-33w7MediumCVSS 5.3

The AWP Classifieds WordPress plugin before 4.4.9 does not verify that a request is authorised to...

Vendor

GitHub Security Advisories

Published

October 14, 2026

Last Modified

October 14, 2026

🔗 CVE IDs covered (1)

CVE-2026-96904 →

📋 Description

The AWP Classifieds WordPress plugin before 4.4.9 does not verify that a request is authorised to view a listing when a payment transaction is referenced, allowing unauthenticated attackers to bypass the ownership check on the ad submission page and read the private contact email stored on any listing.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-96904
https://wpscan.com/vulnerability/b3df7272-9b79-4a3c-b230-6c3e97c4bbe5
https://github.com/advisories/GHSA-c67v-qmm6-33w7