/Vulnerability Library

AWP Classifieds <= 4.2.1 - Unauthenticated SQL Injection

CVE-2022-3254
Verified

Description

WordPress Classifieds Plugin before 4.3 contains a SQL injection caused by improper sanitization and escaping of parameters in an AJAX action, letting unauthenticated attackers execute arbitrary SQL commands, exploit requires the premium module to be active.

Severity

Critical

Published Date

February 6, 2026

Template Author

shivam kamboj

CVE-2022-3254.yaml
9.5Severity

CVSS Metrics

References

https://nvd.nist.gov/vuln/detail/CVE-2022-3254https://wpscan.com/vulnerability/546c47c2-5b4b-46db-b754-c6b43aef2660

Remediation Steps

Update to version 4.3 or later.