This vulnerability (CVE-2026-59550) is an unauthenticated SQL Injection (CWE-89) in Strategy11 Team's AWP Classifieds product affecting versions up to 4.4.7. It allows remote attackers to inject SQL commands without any authentication, resulting in a critical security risk with high confidentiality impact and low availability impact. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and scope change. No official fix or patch information is available at this time.

Successful exploitation could allow an unauthenticated attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized disclosure of sensitive information (high confidentiality impact) and limited disruption of service (low availability impact). Integrity impact is not indicated. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting AWP Classifieds. Avoid exposing vulnerable endpoints to untrusted networks where possible.