{"id":"CVE-2026-62031","published":"2026-10-10T20:16:39.237","lastModified":"2026-10-13T13:28:15.717","description":"Unauthenticated SQL Injection in uListing <= 2.2.0 versions.","cvssScore":9.3,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L","cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/ulisting/vulnerability/wordpress-ulisting-plugin-2-2-0-sql-injection-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A SQL injection vulnerability exists in uListing plugin versions up to 2.2.0 that allows unauthenticated attackers to execute arbitrary SQL commands against the application's database. This critical flaw can lead to complete database compromise and unauthorized data access.","exploitability":"Exploitation is straightforward with no authentication required, making it highly attractive to threat actors who can simply send crafted SQL payloads through the affected API endpoints.","blast_radius":"The impact could be severe across all WordPress sites using vulnerable uListing versions, potentially exposing sensitive user data, login credentials, and other database contents to attackers.","remediation":"Upgrade to version 2.2.1 or later to remediate this SQL injection vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["sql-injection","wordpress","unauthenticated","database"],"model":"garnet-coder","analyzedAt":"2026-10-13T08:48:34.826Z"}}