Description

Subscriber SQL Injection in ListingPro <= 2.9.12 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.5",
  "pubDate": "2026-10-06T09:17:54.320Z",
  "pubdate": "2026-10-06T09:17:54.320Z",
  "executiveSummary": "The vulnerability identified in ListingPro versions 2.9.12 and below is a SQL Injection (SQLi) flaw specifically exploitable by authenticated users with the Subscriber role.\nThis vulnerability stems from improper sanitization of user-supplied data in the application's database queries. By injecting malicious SQL statements, an attacker can manipulate the database, potentially leading to unauthorized data exposure, extraction of sensitive information, or modification of application data.\nThe attack is performed via the authenticated subscriber interface, meaning the attacker must possess a valid user account. The potential impact is significant, as successful exploitation can grant an attacker unauthorized access to sensitive backend information or even lead to a full compromise of the database integrity depending on the database configuration and permissions.\nThis represents a high-risk security issue that demands immediate attention. System administrators should prioritize updating the ListingPro plugin to a version where this vulnerability has been remediated and implement robust input validation mechanisms to prevent similar injection vulnerabilities.",
  "technicalDetails": "The vulnerability is categorized as a SQL Injection (SQLi), classified under CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'). It resides in the ListingPro plugin, affecting versions up to and including 2.9.12.\nThe root cause of this issue is the failure to properly sanitize and parameterize user input before incorporating it into SQL queries. When a user submits data through input fields accessible to a subscriber-level account, the backend application fails to adequately treat this input as untrusted data. Consequently, the input is concatenated directly into SQL query strings, allowing an attacker to escape the intended query structure and execute arbitrary SQL commands.\nThe attack flow begins with the authenticated user interacting with a vulnerable feature of the ListingPro plugin. The user submits a specially crafted payload—containing malicious SQL syntax—through an input field. The application processes this input without sufficient validation or the use of prepared statements (parameterized queries). As a result, the malicious payload is executed by the database engine within the context of the application's database user.\nThis vulnerability is reachable via the authenticated subscriber interface. An attacker does not require administrative privileges, merely a standard subscriber account. Because the application processes these requests on the backend, the vulnerability is reachable over the network.\nPost-exploitation, an attacker could potentially conduct unauthorized data exfiltration, read records from arbitrary tables, perform unauthorized modifications or deletions of data, or leverage the database's extended functionality, such as reading or writing files if the database configuration permits. The scope of impact is contingent upon the database user's privileges configured within the web application environment, which can often lead to a critical compromise of application confidentiality and integrity."
}