ListingPro EUVD-2026-93051

Requires a valid authenticated WordPress Subscriber-level account (PR:L) on a site running the ListingPro plugin version 2.9.12 or earlier; exploitation is most practical where self-registration is enabled, which grants attackers a Subscriber account on demand. The injectable code path lives in the ListingPro plugin, so only sites with this plugin installed and activated are affected. Limiting factors: if user registration is disabled or restricted, an attacker must first obtain Subscriber credentials, raising the effective bar; sites already upgraded past 2.9.12 are not exposed.

This is a genuinely actionable issue but below the top-tier of urgency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L, score 8.5) indicates a network-reachable, low-complexity SQL injection requiring only low privileges (PR:L) and no user interaction, with high confidentiality impact and a changed scope. The PR:L combined with the title 'Subscriber SQL Injection' confirms a low-privilege authenticated attacker (a Subscriber account) is sufficient - this is the key risk amplifier because WordPress sites frequently allow open self-registration at Subscriber level, effectively lowering the bar close to unauthenticated. No EPSS score, CISA KEV listing, POC flag, or SSVC decision data was supplied, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The signals are therefore internally consistent (high CVSS driven by easy authenticated network access to a SQLi) but one-dimensional: without EPSS or KEV, likelihood of widespread exploitation cannot be quantified. Treat as a high-priority patch for any site running open registration, and a medium priority where registration is closed/moderated. Note the I:N/A:L split suggests Patchstack assessed this as primarily a data-disclosure SQLi rather than a full read/write compromise.

An attacker registers (or uses) a low-privilege Subscriber account on a WordPress site running ListingPro <= 2.9.12, then submits a crafted parameter to a plugin endpoint that concatenates input into a SQL query. The injection lets them extract sensitive database contents such as user records, password hashes, or session/secret data. No public exploit code was identified at time of analysis, and the low attack complexity (AC:L) means a working payload would be straightforward to develop.