CVE-2026-42414

Summary

A SQL injection vulnerability in ListingPro allows authenticated attackers to execute arbitrary SQL commands against the database, potentially leading to full database compromise and data exposure. This affects versions up to 2.9.12.

Exploitability

Exploitation requires an authenticated user account with subscriber privileges, making it moderately difficult but not highly complex to achieve.

Blast radius

If exploited, this vulnerability could allow attackers to access sensitive customer data, modify listings, and potentially escalate to full database control across affected installations.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to ListingPro version 2.9.13 or later to remediate this SQL injection vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.