EUVD-2026-41246
GHSA-44q8-hvgm-2g23
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Administrator credentials required to reach vulnerable admin log pages (PR:H); read-only ORDER BY injection yields C:H with no integrity or availability impact.
Primary rating from Vendor (wordfence).
CVSS VectorVendor: wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Houzez Property Feed plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter in all versions up to, and including, 2.5.46 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query in the prepare_items() method of the Houzez_Property_Feed_Admin_Logs_Export_Table (and Houzez_Property_Feed_Admin_Logs_Import_Table) class. The user-controlled $_GET['orderby'] and $_GET['order'] values are filtered only with sanitize_text_field() and then concatenated into the SQL format string before $wpdb->prepare() is called - prepare() only parameterizes the appended LIMIT/OFFSET clause and cannot retroactively secure the already-tainted ORDER BY clause. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
AnalysisAI
SQL injection in the Houzez Property Feed WordPress plugin (versions up to and including 2.5.46) permits authenticated administrators to exfiltrate arbitrary data from the underlying WordPress database by manipulating the orderby GET parameter on admin log pages. The root cause is a $wpdb->prepare() misuse pattern: user-supplied $_GET['orderby'] and $_GET['order'] values are filtered only with sanitize_text_field() - which does not neutralize SQL metacharacters - then concatenated directly into the SQL format string before prepare() is invoked, meaning prepare() only parameterizes the trailing LIMIT/OFFSET clause and cannot retroactively secure the already-tainted ORDER BY clause. No public exploit has been identified at time of analysis, and the high privilege requirement (WordPress Administrator) significantly constrains the realistic attacker pool.
Technical ContextAI
The flaw is a CWE-89 (Improper Neutralization of Special Elements in an SQL Command) instantiation of a well-known WordPress $wpdb->prepare() misuse pattern. The affected code resides in the prepare_items() method of two admin table classes - Houzez_Property_Feed_Admin_Logs_Export_Table and Houzez_Property_Feed_Admin_Logs_Import_Table - in includes/class-houzez-property-feed-admin-logs-export-table.php (lines 205, 219) and includes/class-houzez-property-feed-admin.php (lines 138, 587), as confirmed by WordPress plugin Trac source references. sanitize_text_field() is a text-cleaning utility designed to strip HTML and excess whitespace; it provides no SQL escaping and does not prevent ORDER BY clause manipulation. Because the tainted value is interpolated into the SQL string prior to $wpdb->prepare() being called, the parameterization step is structurally unable to remediate the injection. The Houzez Property Feed plugin provides real estate property syndication, import, and export functionality for WordPress sites built on the Houzez theme, and its admin log interface is the sole attack surface.
RemediationAI
The primary remediation is to update the Houzez Property Feed plugin to a version beyond 2.5.46. A fix has been committed to the WordPress plugin Trac repository (changeset 3592406, referenced at https://plugins.trac.wordpress.org/changeset?old=3592406%40houzez-property-feed&new=3592406%40houzez-property-feed), but the specific patched release version is not confirmed from available data - verify the current plugin version in the WordPress Plugin Directory before updating, and consult the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/7669f1d3-450c-4c17-aa1e-44ddda194727 for the latest patch status. As a compensating control prior to patching, restrict WordPress Administrator access strictly to fully trusted personnel and review the current administrator account roster for any unauthorized or stale accounts. Deploying a WAF rule to block SQL metacharacters (single quotes, double dashes, UNION keywords) in GET parameters named orderby or order on the /wp-admin/ path can reduce exploitation feasibility with low side-effect risk. Temporarily deactivating the Houzez Property Feed plugin eliminates the attack surface entirely if the import/export log functionality is not actively needed, though this will also disable all property feed synchronization features.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today