CVE Intelligence
Analysis AI-assisted

CVE-2026-62031: Stylemix uListing WordPress plugin SQL Injection

CVE-2026-62031 is an unauthenticated SQL Injection (CWE-89) in the Stylemix uListing WordPress plugin, affecting versions up to and including 2.2.0. The CNA and NVD record a CVSS 3.1 base score of 9.3 (critical). No fixed version is listed in the sources consulted, and no confirmed exploitation appears in them.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

The record describes an unauthenticated SQL Injection in the uListing WordPress plugin published by Stylemix. The affected range is up to and including 2.2.0. The weakness is classified as CWE-89 (SQL Injection). Details are summarized from the Patchstack entry and the NVD record.

Impact

  • The CVSS 3.1 vector in the record is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L, meaning network-reachable, low complexity, no privileges or user interaction required, scope changed.
  • The vector rates confidentiality impact as high, integrity impact as none and availability impact as low.
  • SQL Injection flaws can allow unauthorized reading of database content; the actual extent depends on the site configuration, which is not described in the record.

Affected products and versions

  • Product: Stylemix uListing (WordPress plugin).
  • Affected: up to and including 2.2.0.
  • Fixed version: not listed in the record; this is unknown, not a confirmation that no fix exists.

Exploitation status

This CVE is not listed in the CISA KEV catalog in the sources consulted. No confirmed exploitation appears in the sources consulted. SSVC data in the record lists exploitation as none and automatable as yes. The EPSS probability is 0.00291 (percentile 0.20599) dated 2026-10-23; this is a statistical estimate and not evidence of exploitation.

Remediation and mitigation

  • Identify whether uListing is installed on your WordPress sites and which version is in use.
  • The record lists no fixed version. Check the Patchstack entry and the plugin vendor for an updated release and apply it as soon as it is available.
  • If no fix is available, consider deactivating the plugin or restricting access to the affected functionality until a fix is confirmed.
  • Use a web application firewall as a temporary compensating control, and apply the principle of least privilege to the database account used by the site.

Detection guidance

  • Review web server and application logs for unusual or malformed requests directed at uListing components.
  • Monitor for unexpected database errors or abnormal database activity associated with the site.
  • Maintain verified backups so that data integrity can be checked and restored if needed.

Limitations of the available information

  • The record has source status Deferred and no fixed version.
  • Only the Patchstack entry and the NVD and CVE.org pages were available; no vendor advisory was provided in the record.
  • The vulnerable parameter, endpoint and exact exploitation conditions are not described, so their scope cannot be verified from the record.

Frequently asked questions

Which versions of uListing are affected by CVE-2026-62031?

The record lists the Stylemix uListing plugin up to and including 2.2.0. No fixed version is listed in the sources consulted.

Is this vulnerability being actively exploited?

This CVE is not listed in the CISA KEV catalog in the sources consulted, and no confirmed exploitation appears in them. SSVC data in the record lists exploitation as none.

What should site owners do now?

Check whether uListing 2.2.0 or earlier is installed, watch the vendor and Patchstack entry for a fix, and consider deactivating the plugin or restricting access until a fix is confirmed.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.