What is the CVSS score of CVE-2026-39438?

CVE-2026-39438 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.4%.

Which versions of ListingPro are affected by CVE-2026-39438?

ListingPro WordPress plugin versions 2.9.10 and earlier contain an unauthenticated SQL injection vulnerability (CVSS 9.3) that permits direct database access and manipulation without credentials.

How to fix or mitigate CVE-2026-39438?

24 hours: Enumerate all WordPress instances running ListingPro ≤ 2.9.10; implement WAF rules to block SQL injection patterns; restrict WordPress database user permissions to minimum necessary access; enable database query logging. 7 days: Deactivate and remove ListingPro plugin from all affected systems; deploy database access alerts and anomaly detection. 30 days: Migrate to alternative listing solution; audit database logs for unauthorized access post-incident.

ListingPro CVE-2026-39438

EUVD-2026-37469 CRITICAL

SQL Injection (CWE-89)

2026-06-16 Patchstack

SQLi Listingpro

9.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

9.4 CRITICAL

Unauthenticated network-reachable SQLi on a WordPress plugin endpoint; typical SQLi grants full read and write to the WordPress DB, so C:H/I:H, with scope unchanged since impact is within the same DB authority.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 23:42 vuln.today

DescriptionCVE.org

Unauthenticated SQL Injection in ListingPro <= 2.9.10 versions.

AnalysisAI

Unauthenticated SQL injection in the ListingPro WordPress plugin (versions ≤ 2.9.10) allows remote attackers to inject arbitrary SQL into backend queries without credentials, exposing the WordPress database to extraction and manipulation. Reported by Patchstack and tracked as EUVD-2026-37469, the flaw carries a 9.3 CVSS with scope change, indicating impact beyond the vulnerable component. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Fingerprint WordPress site running ListingPro ≤ 2.9.10

Delivery

Identify vulnerable listing/search parameter

Exploit

Send crafted SQLi payload over HTTP

Execution

Extract wp_users credentials via UNION SELECT

Persist

Crack admin password hash

Impact

Authenticate to wp-admin and upload PHP webshell

Access

Fingerprint WordPress site running ListingPro ≤ 2.9.10

Delivery

Identify vulnerable listing/search parameter

Exploit

Send crafted SQLi payload over HTTP

Execution

Extract wp_users credentials via UNION SELECT

Persist

Crack admin password hash

Impact

Authenticate to wp-admin and upload PHP webshell

Vulnerability AssessmentAI

Exploitation	The target site must have the ListingPro plugin installed and activated at version 2.9.10 or earlier, and the vulnerable endpoint must be reachable over HTTP/HTTPS from the attacker - which is the default for a WordPress directory site since ListingPro exposes public-facing listing and search functionality. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N is maximally permissive: remotely reachable, no authentication, no user interaction, and low attack complexity, which is consistent with the unauthenticated SQLi description. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker enumerates WordPress sites running ListingPro (via wp-content/plugins/listingpro-plugin fingerprints or readme.txt) and sends a crafted HTTP request to the vulnerable parameter, injecting a UNION SELECT payload that returns hashed credentials and user emails from wp_users. With no public exploit identified at time of analysis, mass exploitation is not yet expected, but the trivial AV:N/AC:L/PR:N profile means weaponization by commodity scanners is straightforward once a working payload is published.
Remediation	Upstream fix availability is not independently confirmed in the provided data - the Patchstack reference indicates the vulnerability affects versions ≤ 2.9.10, implying a fix in a later release, but no exact patched version is enumerated here, so administrators should consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/listingpro-plugin/vulnerability/wordpress-listingpro-plugin-2-9-10-sql-injection-vulnerability) and upgrade to the latest ListingPro release published by Emraan Cheema. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

24 hours: Enumerate all WordPress instances running ListingPro ≤ 2.9.10; implement WAF rules to block SQL injection patterns; restrict WordPress database user permissions to minimum necessary access; enable database query logging. …

Threat intelligence, references, and detailed analysis are available after sign-in.