{"id":"CVE-2026-42414","published":"2026-10-06T09:17:54.320","lastModified":"2026-10-06T15:04:25.990","description":"Subscriber SQL Injection in ListingPro <= 2.9.12 versions.","cvssScore":8.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L","cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/listingpro-plugin/vulnerability/wordpress-listingpro-plugin-2-9-12-sql-injection-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A SQL injection vulnerability in ListingPro allows authenticated attackers to execute arbitrary SQL commands against the database, potentially leading to full database compromise and data exposure. This affects versions up to 2.9.12.","exploitability":"Exploitation requires an authenticated user account with subscriber privileges, making it moderately difficult but not highly complex to achieve.","blast_radius":"If exploited, this vulnerability could allow attackers to access sensitive customer data, modify listings, and potentially escalate to full database control across affected installations.","remediation":"Upgrade to ListingPro version 2.9.13 or later to remediate this SQL injection vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["sql-injection","authenticated","web","database"],"model":"garnet-coder","analyzedAt":"2026-10-14T08:54:29.642Z"}}