Critical Unauthenticated SQL Injection Found in Stylemix uListing Plugin

The National Vulnerability Database published CVE-2026-62031, identifying a critical security flaw in the Stylemix uListing plugin. This vulnerability allows attackers to execute unauthenticated SQL injection attacks against websites running versions of the software up to and including 2.2.0. The high severity rating reflects the ease of exploitation and the potential for significant data compromise.

Security researchers and the NVD have assigned a CVSS score of 9.3 to this issue, classifying it as critical. The weakness stems from improper neutralization of special elements in SQL commands, known as CWE-89. Because the injection is unauthenticated, attackers do not need valid login credentials to exploit the flaw. This significantly lowers the barrier for malicious actors targeting vulnerable installations.

Context and Background

SQL injection remains one of the most dangerous web application vulnerabilities due to its potential for complete database compromise. In this specific case, the flaw exists within the uListing plugin developed by Stylemix. The plugin is designed to help website owners create and manage listing directories, a common feature for business and community sites. The presence of an unauthenticated vector means that automated scanning tools can likely detect and exploit the vulnerability without human intervention.

The National Vulnerability Database serves as the U.S. government’s central repository for standardized vulnerability management data. When the NVD assigns a score of 9.3, it indicates that the vulnerability is easily exploitable and that successful exploitation could result in total loss of confidentiality, integrity, or availability of the affected system. For directory-based websites, this could mean the exposure of sensitive user data, listing details, and potentially administrative credentials.

Who Is Affected

Stylemix uListing users running version 2.2.0 or any earlier release are directly affected by CVE-2026-62031. Any website utilizing this specific plugin version is potentially vulnerable to SQL injection attacks. Site administrators must verify their current plugin version immediately to determine if they fall within the affected range. The vulnerability does not apply to versions newer than 2.2.0, assuming those versions address the underlying code issue.

Organizations that host multiple websites or manage large networks of WordPress installations need to audit their plugin libraries thoroughly. The unauthenticated nature of the attack means that external threat actors can target any exposed instance from the internet. There is no requirement for prior access to the site’s admin panel or user accounts, making the attack surface broad and the risk immediate for unpatched systems.

What should you do?

Site owners should prioritize verifying their uListing plugin version against the affected list. If the version is 2.2.0 or lower, the system is at risk until a fix is applied. Administrators should monitor their web server logs for suspicious SQL-related queries or unusual traffic patterns that may indicate exploitation attempts. Keeping all software components up to date is a critical defense strategy against such widespread vulnerabilities.