AWP Classifieds: Arbitrary PHP file upload via ZIP import
Summary
The AWP Classifieds WordPress plugin before 4.4.9 does not validate the file types extracted from uploaded ZIP archives during its listing-import feature. An authenticated user with plugin management rights can upload arbitrary PHP files to a publicly accessible, network-shared directory. This can lead to remote code execution on the web server.
Affected
- AWP Classifieds (another-wordpress-classifieds-plugin), all versions before 4.4.9
Fixed in
- Version 4.4.9 or later
Workaround
- Limit the plugin's management capability to a minimal set of trusted accounts.
- Do not use the listing-import feature until the update is applied.
- Ensure the upload/import directory does not execute PHP, e.g. via web server rules.
- Check the import directory for unexpected PHP files and review admin logs.
Exploitation
- No evidence of active exploitation found. One tracker reports it is not listed in CISA KEV.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
- No public proof of concept found.
- EPSS scores differ between sources and are unverified.
Our recommendation
- Inventory all WordPress sites using this plugin and record the version.
- Update to 4.4.9 or later and confirm the version afterwards.
- Review administrator and editor accounts, enforce strong passwords and MFA, and remove unused accounts.
- Check import and upload directories for unexpected PHP files and review logs for recent imports.
- Monitor NVD, the WPScan entry and the wordpress.org plugin changelog.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- WPScan: AWP Classifieds < 4.4.9 - Admin+ Arbitrary File Upload via ZIP Import wpscan.com
- VulDB: CVE-2025-15700 vuldb.com
- Vulners (Rapid7): CVE-2025-15700 vulners.com
- CVEBrief archive 2026/10/10 cvebrief.com
- Threat intel record: CVE-2025-15700 cve.threatint.com
- GitHub issue tracker entry for CVE-2025-15700 github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 21:04.
Original description (NVD)
The AWP Classifieds WordPress plugin before 4.4.9 does not validate the type of files extracted from an uploaded ZIP archive during its listing-import feature, allowing users with the AWP Classifieds WordPress plugin before 4.4.9's management capability to upload arbitrary PHP files to a publicly accessible, network-shared directory and achieve remote code execution.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.