ListingPro plugin: SQL injection by authenticated subscribers
Summary
The ListingPro WordPress plugin up to and including version 2.9.12 contains an SQL injection vulnerability (CWE-89). An attacker with a low-privileged subscriber account can inject SQL commands, which can allow reading, modifying or deleting database content, including user accounts and private data. No fixed version has been confirmed, and the CVSS score of 8.5 comes from the CNA record and may change after NVD analysis.
Affected
- ListingPro WordPress plugin, versions up to and including 2.9.12
- Required privilege: Subscriber (authenticated)
Fixed in
Unknown. No vendor advisory or patched release has been confirmed. Do not assume that 2.9.12 or a later version is safe.
Workaround
- Close open user registration and review accounts with the subscriber role.
- Disable or remove the plugin where it is not needed.
- Ask your WAF or hosting provider about virtual patching; a mitigation rule could not be confirmed for this CVE.
- Review logs for unusual requests to ListingPro endpoints and for new accounts.
Exploitation
- No CISA KEV entry known.
- CISA SSVC assessment: exploitation none, automatable no, technical impact partial.
- Patchstack rates the issue as high priority and expects exploitation; public proof of concept: unknown.
Our recommendation
- Check whether ListingPro plugin version 2.9.12 or earlier is installed.
- Restrict or disable user registration now.
- Ask CridioStudio or Patchstack for a fix timeline and apply the fix as soon as it is available.
- Monitor logs and database for suspicious activity.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory CVE-2026-42414 patchstack.com
- HOL Guard CVE-2026-42414 hol.org
- Strix CVE-2026-42414 www.strix.ai
- OffSeq CVE record details radar.offseq.com
- WPScan ListingPro plugin wpscan.com
- Patchstack ListingPro plugin vulnerabilities patchstack.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 11:22.
Original description (NVD)
Subscriber SQL Injection in ListingPro <= 2.9.12 versions.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.