uListing EUVD-2026-96466

Exploitation requires the uListing plugin by StyleMix (versions <= 2.2.0) to be installed and active on a network-reachable WordPress site; no authentication (PR:N) and no user interaction (UI:N) are needed, so default installations are exposed to remote attackers. The limiting factor is that the attack is confined to sites actually running this specific plugin version. The Patchstack description does not name the exact vulnerable parameter, request endpoint, or any required non-default configuration, so the precise injectable input is unconfirmed and would need verification against the plugin source or vendor advisory.

This is a genuine high-priority issue on signal convergence, though with notable data gaps. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes the worst-case exposure profile for a web vulnerability: remote, network-reachable, low-complexity, and - critically - unauthenticated (PR:N), matching the description's explicit 'Unauthenticated SQL Injection' claim, so the CVSS and description agree. The 9.3 score is driven largely by S:C (scope change) combined with C:H; interestingly, Patchstack rated I:N and A:L, implying the identified injection primarily enables data disclosure rather than authenticated write/modification, which is somewhat conservative for a SQLi (many SQLi flaws also permit data tampering). No EPSS score was provided, so exploitation probability cannot be quantified. The vulnerability is NOT in CISA KEV and no public POC is referenced, so there is no public exploit identified at time of analysis - this tempers urgency relative to a KEV-listed flaw. Net: unauthenticated SQLi in a WordPress plugin is a classic mass-scannable target class, so patching should be prioritized where the plugin is deployed, but the absence of EPSS/KEV/POC data means this is a 'patch promptly' rather than 'emergency' item, and the real-world footprint of the uListing plugin limits blast radius.

A remote, unauthenticated attacker sends a crafted HTTP request to a WordPress site running uListing <= 2.2.0, injecting malicious SQL through an unsanitized parameter to read sensitive database contents such as user records and credential hashes. Because no authentication or user interaction is required (PR:N/UI:N) and complexity is low, the request can be automated and sprayed across many sites. No public exploit code is referenced at time of analysis, so weaponization would require an attacker to first identify the specific vulnerable parameter.