Attack Chain

1. An unauthenticated attacker identifies a WordPress website using a vulnerable version of the AWP Classifieds plugin (<=4.4.5).
2. The attacker crafts a malicious HTTP request targeting the page search functionality.
3. The attacker injects SQL code into the ‘regions’ parameter array keys within the crafted request.
4. The vulnerable code fails to properly sanitize the injected SQL code.
5. The application executes the attacker-controlled SQL query against the WordPress database.
6. The attacker is able to extract sensitive information, such as user credentials or other confidential data, from the database.
7. The attacker may use the extracted information to further compromise the WordPress website or related systems.

Impact

Successful exploitation of this SQL Injection vulnerability (CVE-2026-5100) in the AWP Classifieds plugin could allow unauthenticated attackers to extract sensitive information from the affected WordPress database. This may include user credentials, personal data, or other confidential business information. The compromise of this information can lead to identity theft, financial fraud, and reputational damage. There is no victim count available, but all sites running vulnerable versions of this plugin are at risk.

Recommendation

• Upgrade the AWP Classifieds plugin to the latest version to patch CVE-2026-5100.
• Deploy the provided Sigma rule Detect AWP Classifieds SQL Injection Attempt to detect exploitation attempts in web server logs.
• Implement a web application firewall (WAF) with rules to filter out malicious SQL injection payloads targeting the ‘regions’ parameter.
• Review and harden database access controls to limit the potential impact of successful SQL injection attacks.