WordPress Classifieds Plugin – Ad Directory & Listings by AWP Classifieds - SQLi (CVE-2022-3254)

CVE-2022-3254 is a critical SQL injection vulnerability in the WordPress Classifieds Plugin – Ad Directory & Listings by AWP Classifieds, affecting versions before 4.3. This flaw allows unauthenticated attackers to exploit improperly sanitized parameters via AJAX actions, potentially leading to unauthorized access, data theft, or manipulation of the underlying database when a specific premium module is active.

CrowdSec has been tracking this vulnerability and its exploits since 30th of March 2026.

CrowdSec network observations suggest that most exploitation of CVE-2022-3254 involves focused reconnaissance to identify viable targets. Attackers typically tailor their campaigns based on system exposure and configuration. It is unlikely that a given attack is accidental. In addition, according to the CrowdSec network, attack volume against CVE-2022-3254 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.

Attackers exploit the /wp-admin/admin-ajax.php endpoint with the action=awpcp-get-regions-options parameter, injecting SQL commands via the parent parameter to perform unauthenticated SQL injection attacks.