What is the CVSS score of EUVD-2026-37469?

EUVD-2026-37469 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.4%.

Which versions of ListingPro are affected by EUVD-2026-37469?

ListingPro WordPress plugin versions 2.9.10 and earlier contain an unauthenticated SQL injection vulnerability (CVSS 9.3) that permits direct database access and manipulation without credentials.

How to fix or mitigate EUVD-2026-37469?

24 hours: Enumerate all WordPress instances running ListingPro ≤ 2.9.10; implement WAF rules to block SQL injection patterns; restrict WordPress database user permissions to minimum necessary access; enable database query logging. 7 days: Deactivate and remove ListingPro plugin from all affected systems; deploy database access alerts and anomaly detection. 30 days: Migrate to alternative listing solution; audit database logs for unauthorized access post-incident.

ListingPro EUVD-2026-37469

| CVE-2026-39438 CRITICAL

SQL Injection (CWE-89)

2026-06-16 Patchstack

SQLi Listingpro

9.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

9.4 CRITICAL

Unauthenticated network-reachable SQLi on a WordPress plugin endpoint; typical SQLi grants full read and write to the WordPress DB, so C:H/I:H, with scope unchanged since impact is within the same DB authority.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 23:42 vuln.today

DescriptionCVE.org

Unauthenticated SQL Injection in ListingPro <= 2.9.10 versions.

AnalysisAI

Unauthenticated SQL injection in the ListingPro WordPress plugin (versions ≤ 2.9.10) allows remote attackers to inject arbitrary SQL into backend queries without credentials, exposing the WordPress database to extraction and manipulation. Reported by Patchstack and tracked as EUVD-2026-37469, the flaw carries a 9.3 CVSS with scope change, indicating impact beyond the vulnerable component. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

ListingPro is a commercial WordPress directory/listing plugin by Emraan Cheema (CPE: cpe:2.3:a:emraan_cheema:listingpro). The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning user-controllable input is concatenated into SQL queries without proper parameterization or escaping via $wpdb->prepare(). Because the plugin runs inside WordPress and queries the shared wp_* schema, a successful injection reaches the same database that stores user credentials, session tokens, and site configuration - explaining the CVSS scope change (S:C).

RemediationAI

Upstream fix availability is not independently confirmed in the provided data - the Patchstack reference indicates the vulnerability affects versions ≤ 2.9.10, implying a fix in a later release, but no exact patched version is enumerated here, so administrators should consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/listingpro-plugin/vulnerability/wordpress-listingpro-plugin-2-9-10-sql-injection-vulnerability) and upgrade to the latest ListingPro release published by Emraan Cheema. As compensating controls until patched, deploy a WordPress WAF rule (Patchstack, Wordfence, or equivalent) that blocks SQL meta-characters on the vulnerable plugin endpoints, restrict access to the affected listing/search endpoints via IP allowlist or HTTP auth if business workflows permit (with the side effect of breaking public directory functionality), and enable database query logging plus MySQL least-privilege so the WordPress DB user cannot execute FILE or administrative statements. Rotate WordPress salts, admin passwords, and any API tokens stored in wp_options after patching, since pre-patch credential exposure cannot be ruled out.