CVE-2026-39438: WordPress ListingPro plugin <= 2.9.10 - SQL Injection vulnerability

Synopsis

An unauthenticated SQL injection vulnerability affects the WordPress ListingPro plugin at version 2.9.10 and earlier. The flaw is reachable over the network with no authentication or user interaction required, meaning any remote party can send a crafted request to a vulnerable site. Successful exploitation gives an attacker read access to the underlying database and causes minor availability disruption. No fix version has been published; HarborGuard tracks the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network; an attacker must be able to reach the WordPress site via HTTP or HTTPS to deliver a malicious payload.

• AuthenticationNot required

  No account or session token is needed; the injection can be triggered by any unauthenticated HTTP request.

• Victim interactionNot required

  No victim action is required; the attacker sends requests directly to the server without any social-engineering step.

• Attack complexityDetail

  Attack complexity is Low, meaning the exploit is reliable and requires no special preconditions, race conditions, or environmental tuning.

Blast Radius

• An attacker reads arbitrary rows from the WordPress database, including stored user credentials (hashed passwords), email addresses, private post content, and plugin configuration data.
• Because scope is Changed (S:C in the CVSS vector), data from database tables beyond the plugin's own scope may be accessible, potentially exposing data belonging to other applications sharing the same database server.
• Availability impact is Low; repeated exploitation may degrade query performance or cause intermittent errors on the affected WordPress site.