CVE-2026-5100: 
WordPress vulnerability analysis and mitigation

CVE-2026-5100 is a SQL Injection vulnerability in the AWP Classifieds (Another WordPress Classifieds Plugin) plugin for WordPress, affecting versions up to and including 4.4.5. The flaw exists in the handling of the regions parameter array keys, where insufficient escaping and lack of prepared statements allow unauthenticated attackers to append malicious SQL queries to extract sensitive database information. It was published on May 5, 2026, with a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory).

The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). The root cause lies in the plugin's failure to properly escape user-supplied input in the regions parameter array keys and the absence of prepared statements in the underlying SQL queries. Vulnerable code paths have been identified in multiple files including frontend/page-search-ads.php (lines 63, 70, 168, 174), functions.php (lines 1240, 1258, 1269, 1276), includes/class-awpcp.php (lines 339, 342), and includes/listings/class-query-integration.php (lines 795, 804, 881–903). Because no authentication is required and the attack complexity is low, exploitation requires only a crafted HTTP request targeting the search ads functionality (GitHub Advisory).

Successful exploitation allows unauthenticated remote attackers to extract sensitive information from the WordPress database, including user credentials, personal data, plugin configuration, and any other data stored in the database. The confidentiality impact is rated High, while integrity and availability are unaffected by this vulnerability alone. However, extracted credentials (e.g., WordPress admin hashes) could enable further compromise, including full site takeover (GitHub Advisory).

1. Reconnaissance: Identify WordPress sites running the AWP Classifieds plugin version 4.4.5 or earlier using tools like WPScan, Shodan, or by inspecting plugin directories exposed via the target site.
2. Locate the vulnerable endpoint: Navigate to the plugin's ad search functionality, which processes the regions parameter — typically accessible via the search ads page (e.g., /wp-admin/admin-ajax.php or a front-end search page).
3. Craft a malicious request: Submit an HTTP request with a manipulated regions parameter where the array keys contain SQL injection payloads (e.g., regions[1 UNION SELECT user_login,user_pass FROM wp_users-- -]=1).
4. Extract database contents: Use time-based or UNION-based SQL injection techniques to enumerate database tables and extract sensitive records such as WordPress user credentials, email addresses, or plugin data.
5. Post-exploitation: Use extracted password hashes with offline cracking tools (e.g., Hashcat) to recover plaintext credentials, potentially enabling WordPress admin login and full site compromise (GitHub Advisory).

• Network: Unusual HTTP requests to WordPress search/ad pages containing SQL syntax in the regions[] parameter (e.g., UNION SELECT, SLEEP(), --, OR 1=1) in query strings or POST bodies.
• Logs: WordPress or web server access logs showing repeated requests to page-search-ads.php or equivalent endpoints with anomalous regions parameter values; database error messages logged in WordPress debug logs indicating malformed SQL queries.
• Process/Application: Unexpected database query errors or slow query log entries in MySQL/MariaDB corresponding to injected SQL payloads targeting the AWP Classifieds plugin tables.

WordPress site administrators should upgrade the AWP Classifieds plugin to a version newer than 4.4.5 as the primary remediation (GitHub Advisory). If an immediate upgrade is not feasible, consider temporarily disabling or removing the plugin to eliminate the attack surface. As an additional layer of defense, deploy a Web Application Firewall (WAF) with rules to detect and block SQL injection attempts targeting the regions parameter. Wordfence has documented this vulnerability and may provide virtual patching for users of their security plugin (Wordfence).

Wordfence included CVE-2026-5100 in their weekly WordPress vulnerability reports for the weeks of May 4–10 and May 11–17, 2026, highlighting it as a notable SQL injection risk for WordPress site operators. RedPacket Security also published an alert and shared it via Mastodon, contributing to broader community awareness. No significant vendor statements or major media coverage beyond routine vulnerability reporting have been observed.