Junglewise Threat Intelligence

CVE-2026-13357: Houzez Property Feed SQL injection in admin logs table

CVE-2026-13357 · Severity: medium · CVSS 4.9 · Published 2026-07-02

Executive brief

The Houzez Property Feed plugin for WordPress, which manages real estate data feeds, contains a security flaw that could allow an authorized administrator to access sensitive information from the site's database. By manipulating specific web addresses used for viewing logs, an attacker can run unauthorized database commands. While this requires high-level access, it could lead to the exposure of private data stored within the WordPress environment.

Technical details

The Houzez Property Feed plugin for WordPress is vulnerable to SQL Injection via the 'orderby' and 'order' GET parameters in the prepare_items() method of the Houzez_Property_Feed_Admin_Logs_Export_Table and Houzez_Property_Feed_Admin_Logs_Import_Table classes. The vulnerability exists because user input is only filtered with sanitize_text_field() before being concatenated directly into a SQL format string. Although $wpdb->prepare() is subsequently called, it only parameterizes the LIMIT/OFFSET clauses, failing to secure the already-tainted ORDER BY clause. An authenticated attacker with Administrator-level privileges can exploit this to append additional SQL queries and extract sensitive information from the database. The issue is addressed in versions following 2.5.46.

Affected products

  • propertyhive Houzez Property Feed up to, and including, 2.5.46

Timeline

  • 2026-07-02: advisory: NVD publication date

References