Key points
- CVE-2026-62031 affects Stylemix uListing versions up to 2.2.0
- The flaw is rated Critical with a CVSS score of 9.3
- Attackers can exploit the vulnerability without authentication
Software developers using the Stylemix uListing WordPress plugin must update immediately to address a critical security flaw. The National Vulnerability Database recorded CVE-2026-62031, which allows unauthenticated SQL injection in versions 2.2.0 and earlier. This vulnerability enables remote attackers to execute arbitrary SQL commands on the database.
The flaw is classified as Critical with a CVSS base score of 9.3. It maps to CWE-89, the standard identifier for SQL Injection. Because the attack requires no authentication, any visitor to the site can potentially exploit the weakness. Developers should verify their installed version against the affected range listed in the NVD record.
What we know
The National Vulnerability Database documented this issue under CVE-2026-62031. The record specifies that the vulnerability exists in Stylemix uListing versions up to and including 2.2.0. Any installation running these older versions is exposed to potential exploitation. The severity rating of 9.3 indicates a high likelihood of successful exploitation and significant impact.
The underlying weakness is identified as CWE-89. This category covers flaws where user input is included in SQL queries without proper sanitization. Attackers can manipulate this input to alter the intended query logic. This often leads to unauthorized data access, modification, or deletion within the database.
Because the injection is unauthenticated, attackers do not need valid login credentials. This lowers the barrier to entry for malicious actors significantly. Automated scanning tools can easily detect and exploit such endpoints. The lack of authentication requirements makes this a high-priority threat for web administrators.
Defender's checklist
- Verify the installed version of Stylemix uListing on all managed sites.
- Confirm that the version is strictly greater than 2.2.0 to avoid exposure.
- Review database logs for unusual SQL query patterns or errors.
- Monitor web server access logs for suspicious request parameters.
What to do and how to stay safe: Stylemix
- Audit all WordPress installations for the Stylemix uListing plugin.
- Update the plugin to the latest secure version available from the vendor.
- Restrict database access permissions for the web application user account.
- Monitor server logs for signs of SQL injection attempts or unauthorized access.
Step-by-step guide: Security Advisories: Small Business Patching Strategy
General security guidance from the Malware Chronicle newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of Stylemix uListing are affected by CVE-2026-62031?
Versions up to and including 2.2.0 are affected by this critical SQL injection vulnerability.
Is authentication required to exploit this vulnerability?
No, the SQL injection flaw is unauthenticated, allowing remote attackers to exploit it without credentials.
What is the CVSS score for CVE-2026-62031?
The National Vulnerability Database rates the severity as Critical with a CVSS score of 9.3.
