Houzez Property Feed <=2.5.46 Authenticated SQL Injection via 'orderby' (CVE-2026-13357)

Vulnerability Overview Vulnerability Name: Houzez Property Feed <= 2.5.46 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter CVE ID: CVE-2026-13357 CVSS Score: 4.9 (Medium) Publication Date: July 1, 2026 Last Updated: July 2, 2026 Researcher: PRISM Affected Scope Software Type: Plugin Software Name: Houzez Property Feed Affected Versions: <= 2.5.46 Fixed Version: 2.5.47 Remediation Fix Status: Fixed Fixed Version: Update to version 2.5.47 or higher Vulnerability Description The Houzez Property Feed plugin contains an SQL injection vulnerability that allows attackers to execute malicious SQL queries by crafting a specific 'orderby' parameter. This vulnerability enables authenticated administrator users to extract sensitive information by manipulating the 'orderby' parameter. References plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org Additional Information License: This vulnerability record is copyrighted under the licensing terms of Defiant Inc. Contact Information: For any questions or errors, please contact support@wordfence.com. Recent Vulnerabilities Houzez Property Feed <= 2.5.4 - Unauthenticated Arbitrary File Download - CVE ID: CVE-2025-30793 - CVSS Score: 7.5 - Researcher: 0xd4k45id3 - Publication Date: March 29, 2025 Houzez Property Feed <= 2.4.21 - Cross-Site Request Forgery to Property Feed Export Deletion - CVE ID: CVE-2025-0808 - CVSS Score: 4.3 - Researcher: Dhabaleshwar Das - Publication Date: February 11, 2025 Summary The Houzez Property Feed plugin contains an SQL injection vulnerability affecting versions 2.5.46 and below. Users are advised to update to version 2.5.47 or higher as soon as possible to remediate this vulnerability.

Goal Reached Thanks to every supporter — we hit 100%!

Houzez Property Feed <=2.5.46 Authenticated SQL Injection via 'orderby' (CVE-2026-13357)

More from this source