PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-39438 Emraan Cheema CVE debrief

A critical vulnerability was discovered in the ListingPro plugin, versions up to 2.9.10. This vulnerability allows unauthenticated attackers to inject malicious SQL, potentially leading to data breaches and system compromise. With a CVSS score of 9.3, this issue is considered CRITICAL. The vulnerability was made public on June 17, 2026. Users of the affected plugin versions should take immediate action to mitigate this risk.

Vendor
Emraan Cheema
Product
ListingPro
CVSS
CRITICAL 9.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-17
Original CVE updated
2026-06-17
Advisory published
2026-06-17
Advisory updated
2026-06-17

Who should care

Administrators and security teams responsible for WordPress installations using the ListingPro plugin, especially those with versions 2.9.10 or earlier, should prioritize patching this vulnerability to prevent potential data breaches and system compromises.

Technical summary

The ListingPro plugin, up to version 2.9.10, is vulnerable to unauthenticated SQL injection. This vulnerability is characterized by a CVSS:3.1 vector of AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L, indicating a high impact on confidentiality, with low attack complexity and no required privileges. The CWE-89 weakness is associated with this vulnerability, signifying an Improper Neutralization of Special Elements used in an SQL Command.

Defensive priority

high

Recommended defensive actions

  • Update the ListingPro plugin to a version beyond 2.9.10 immediately.
  • Implement a Web Application Firewall (WAF) to detect and block suspicious SQL queries.
  • Regularly monitor your WordPress installation for any unusual activity.
  • Restrict access to the ListingPro plugin's functionality to authenticated users only.
  • Consider temporarily disabling the ListingPro plugin until a patch is applied.
  • Perform a thorough audit of your WordPress installation to identify any potential compromises.
  • Keep all WordPress plugins and themes up-to-date to minimize vulnerability exposure.

Evidence notes

This vulnerability was reported by Patchstack and is documented in the NVD. The CVE record and NVD detail pages provide additional context and information about this vulnerability.

Official resources

public