Unauthenticated SQL Injection in Stylemix uListing Risks Data Breach for WordPress Sites

Organisations using the Stylemix uListing plugin for WordPress face immediate risk from a critical security flaw that exposes their databases to unauthorised access. The National Vulnerability Database has recorded this issue as CVE-2026-62031, assigning it a maximum severity rating due to the ease of exploitation and potential impact on data confidentiality.

What is the nature of the vulnerability?

The vulnerability is an unauthenticated SQL injection flaw, classified under CWE-89. This weakness allows attackers to interfere with the queries an application makes to its database. Because the injection is unauthenticated, malicious actors do not need valid credentials to attempt exploitation, significantly broadening the attack surface for any public-facing site using the affected software.

Which software versions are affected?

Stylemix uListing versions up to and including 2.2.0 are affected by this critical issue. Any installation running these versions or older is potentially vulnerable to remote exploitation. Administrators must verify their current plugin version immediately, as older iterations remain exposed to the same SQL injection techniques described in the NVD record.

How severe is the threat according to security ratings?

The National Vulnerability Database rates CVE-2026-62031 as Critical with a CVSS score of 9.3. This high score reflects the severe potential impact on data integrity and confidentiality. The lack of authentication requirements for exploitation further elevates the risk, making it a priority for security teams to address before active exploitation occurs in the wild.

What should IT managers do now?

IT managers should immediately audit their WordPress environments to identify any installations of Stylemix uListing version 2.2.0 or lower. If the plugin is present, they should check for available updates from the vendor. In the absence of a patch, restricting access to the affected endpoints and monitoring for unusual database activity are essential temporary measures to mitigate potential breaches.

What to do and how to stay safe: Stylemix uListing

• Audit WordPress installations to identify any use of Stylemix uListing versions 2.2.0 or earlier.
• Monitor database logs for unusual query patterns or unauthorised access attempts indicative of SQL injection.
• Restrict administrative access to the website backend to reduce the attack surface while awaiting updates.
• Implement web application firewalls to filter out known SQL injection attack signatures.

General security guidance from the Phish Herald newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-62031?

CVE-2026-62031 is a critical unauthenticated SQL injection vulnerability affecting Stylemix uListing versions up to 2.2.0.

Which versions of Stylemix uListing are vulnerable?

All versions of Stylemix uListing up to and including 2.2.0 are affected by this security flaw.

What is the CVSS score for this vulnerability?

The National Vulnerability Database assigns a CVSS score of 9.3, rating the vulnerability as Critical.