Key points
- The flaw affects Stylemix uListing versions up to and including 2.2.0.
- National Vulnerability Database rates the issue as Critical with a CVSS score of 9.3.
- The weakness is classified as CWE-89, indicating an unauthenticated SQL injection vector.
Security teams must address a severe vulnerability in the Stylemix uListing plugin immediately. The issue allows unauthenticated attackers to execute SQL injection attacks against any installation running version 2.2.0 or earlier. This exposure leaves database contents vulnerable to theft or manipulation by remote adversaries without any initial access credentials.
In plain English
SQL injection occurs when an attacker inserts malicious code into a database query. In this specific case, the flaw exists in the uListing plugin developed by Stylemix. Because the vulnerability is unauthenticated, hackers do not need to log in to the website first. They can send crafted requests directly to the server, forcing the database to reveal sensitive information or alter data structures unexpectedly.
The background
The National Vulnerability Database has assigned CVE-2026-62031 to this security defect. The advisory describes the weakness clearly as an unauthenticated SQL injection present in uListing versions less than or equal to 2.2.0. With a CVSS score of 9.3, the rating falls into the Critical severity band. This high score reflects the ease of exploitation and the potential for significant data compromise across affected WordPress environments.
What changes now
Managed service providers should audit all client sites using the Stylemix uListing plugin. Any instance running version 2.2.0 or below is currently exposed to remote attacks. Teams must verify the installed version against this threshold. Until a vendor patch is confirmed and deployed, affected sites remain at risk of unauthorized database access and potential data exfiltration by threat actors scanning for this specific CVE.
What to do and how to stay safe: Stylemix
- Scan all managed WordPress environments to identify installations of Stylemix uListing version 2.2.0 or earlier.
- Review database logs for unusual query patterns or unexpected data exports that may indicate active exploitation.
- Restrict database access permissions where possible to limit the impact if an injection attempt succeeds.
- Monitor vendor communications for an official security update and test it in a staging environment before deployment.
Step-by-step guide: Emergency Patching: Correcting Five Common Operational Errors
General security guidance from the RedTeam Log newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of Stylemix uListing are affected by CVE-2026-62031?
All versions up to and including 2.2.0 are affected by this unauthenticated SQL injection vulnerability.
Is authentication required to exploit this SQL injection flaw?
No, the vulnerability description specifies that the SQL injection is unauthenticated, allowing remote access.
What is the severity rating for CVE-2026-62031?
The National Vulnerability Database rates the vulnerability as Critical with a CVSS score of 9.3.
