CVE-2026-13357: Houzez Property Feed SQL Injection Vulnerability Guide

Technical summary

CVE-2026-13357 is a SQL injection vulnerability in the Houzez_Property_Feed_Admin_Logs_Export_Table and Houzez_Property_Feed_Admin_Logs_Import_Table classes. The prepare_items() method accepts $_GET['orderby'] and $_GET['order'] parameters, applies only sanitize_text_field() filtering, then concatenates these values directly into an SQL format string. The subsequent $wpdb->prepare() call cannot retroactively secure the ORDER BY clause—it only parameterizes the LIMIT/OFFSET portion appended afterward. This improper sequencing allows authenticated administrative users to inject arbitrary SQL syntax into the query, enabling data exfiltration attacks.

Business impact

Compromised WordPress property listing sites can have their entire databases extracted, exposing client information, property details, transaction records, and other sensitive data. For real estate agencies and property management firms using Houzez, this creates regulatory exposure (GDPR, CCPA) and reputational risk. The attack requires administrator credentials, so it primarily threatens multi-user sites or organizations where admin access is over-provisioned.

Affected systems

WordPress installations running the Houzez Property Feed plugin in versions 2.5.46 and earlier. The vulnerability affects both the export and import logging table admin interfaces. Any WordPress site with this plugin enabled and administrator users is potentially at risk.

Exploitability

Exploitation requires valid WordPress administrator credentials and direct access to the WordPress admin dashboard. An attacker cannot exploit this remotely without first compromising admin credentials through other means. Once authenticated, the attack is straightforward—no user interaction is required and the SQL injection is reliable. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, suggesting active exploitation has not been widespread as of the publication date.

Remediation

Update the Houzez Property Feed plugin to a patched version released after 2.5.46. Verify the specific patch version in the official Houzez plugin repository or vendor advisory before deploying. Organizations should restrict WordPress administrator privileges to the minimum required personnel, implement strong access controls, and audit user accounts with elevated permissions.

Patch guidance

Visit the Houzez Property Feed plugin's official page in the WordPress plugin directory or the vendor's website to confirm the available patch version. Apply the update through WordPress's built-in plugin update mechanism once a fixed version is confirmed. Before updating, back up your WordPress database and test the patch in a staging environment to verify compatibility with your site configuration. If you are unsure which version fixes this issue, consult the vendor's security advisory directly.

Detection guidance

Monitor WordPress admin logs and database query logs for unusual ORDER BY clause syntax or multiple concatenated SQL statements originating from the admin dashboard. Check for suspicious values in the 'orderby' parameter of requests to WordPress admin pages related to Houzez logs. Implement Web Application Firewall (WAF) rules to detect SQL injection patterns in GET parameters, particularly those targeting database admin functions. Review access logs for administrators logging in from unexpected IP addresses or at unusual times.

Why prioritize this

Although rated MEDIUM severity due to the high privilege requirement (administrator access), this vulnerability should not be deprioritized entirely. Real estate companies and agencies frequently grant admin access to multiple staff members, increasing the attack surface. The confidentiality impact is high—attackers can extract entire databases. Prioritize patching based on your site's user access model: organizations with broadly distributed admin privileges should treat this as higher priority.

Risk score, explained

The CVSS v3.1 score of 4.9 reflects the high barrier to exploitation (PR:H—administrator privilege required) balanced against a high confidentiality impact (C:H). No integrity or availability impact is possible through this vector. The score appropriately captures that while the technical vulnerability is severe, real-world exploitation is constrained to trusted insiders or attackers who have already compromised admin accounts through other attack chains.

Frequently asked questions