CVE-2026-59550

The CVSS 9.3 score for this unauthenticated SQL injection in AWP Classifieds is technically accurate but contextually misleading. The EPSS probability of 0.00236 places this well below the 1st percentile of actively exploited vulnerabilities — for perspective, mass-exploited CVEs typically score 0.5 or higher. The gap between severity and exploit likelihood here is not a scoring anomaly; it's a signal about actual deployment scope. AWP Classifieds is a WordPress plugin for classified ad listings. That's a functionally narrow use case — local marketplaces, small business directories, niche community sites — not a component that ships with WordPress core or lives on millions of generic installations. The exposed attack surface is likely orders of magnitude smaller than a typical 'critical WordPress vulnerability' headline implies. Unauthenticated SQL injection remains a worst-case vector when it does apply: no authentication required, no exploit complexity, full database compromise possible. For organizations running this specific plugin, the EPSS is irrelevant — they face the full 9.3 severity. The question is whether your environment runs AWP Classifieds at all, and if so, whether version 4.4.7 or earlier is in use. One detail warrants scrutiny: the CVE is dated 2026, which appears forward-dated. Either this is a predictive disclosure or a data artifact in the national database. If legitimate, the EPSS may be artificially depressed because the vulnerability window hasn't fully opened in threat intelligence feeds yet — meaning the current low score could be temporary. The practical posture: verify your plugin inventory for AWP Classifieds. If absent, deprioritize. If present and unpatched, treat this as the critical SQL injection it is — the EPSS-CVSS gap reflects deployment footprint, not severity when the vulnerability actually exists in your environment. The CVSS framework was never calibrated for plugin ecosystems where 'critical' describes potential impact in a hypothetical mass-deployment, not actual risk in the field.

Reviewed through automated stages and approved by a human before publication.