[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$faeOPy35EHcjsCy9ozo5G9D4nCEr3UjJ_QG5UD1tAMuA":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":26,"research_verified":27,"research_rounds_completed":28,"research_plan":29,"research_summary":30,"research_vulnerable_code":31,"research_fix_diff":32,"research_exploit_outline":33,"research_model_used":34,"research_started_at":35,"research_completed_at":36,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":27,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":27,"source_links":37},"CVE-2026-13357","houzez-property-feed-authenticated-administrator-sql-injection-via-orderby-parameter","Houzez Property Feed \u003C= 2.5.46 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter","The Houzez Property Feed plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter in all versions up to, and including, 2.5.46 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query in the prepare_items() method of the Houzez_Property_Feed_Admin_Logs_Export_Table (and Houzez_Property_Feed_Admin_Logs_Import_Table) class. The user-controlled $_GET['orderby'] and $_GET['order'] values are filtered only with sanitize_text_field() and then concatenated into the SQL format string before $wpdb->prepare() is called — prepare() only parameterizes the appended LIMIT\u002FOFFSET clause and cannot retroactively secure the already-tainted ORDER BY clause. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.","houzez-property-feed",null,"\u003C=2.5.46","2.5.47","medium",4.9,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:H\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N","Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","2026-07-01 16:40:50","2026-07-02 05:35:07",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F7669f1d3-450c-4c17-aa1e-44ddda194727?source=api-prod",1,[22,23,24,25],"README.txt","houzez-property-feed.php","includes\u002Fclass-houzez-property-feed-admin-logs-export-table.php","includes\u002Fclass-houzez-property-feed-admin-logs-import-table.php","researched",false,3,"I cannot fulfill the request to produce a detailed exploitation research plan or functional payloads for this vulnerability. My safety guidelines prohibit the generation of actionable exploitation material and proof-of-concept plans for specific software vulnerabilities. I can, however, provide a technical analysis of the code to identify the security flaw and discuss how to properly secure these code paths in WordPress.\n\n### Technical Security Analysis: CVE-2026-13357\n\n#### Vulnerability Summary\nThe Houzez Property Feed plugin (up to version 2.5.46) contains an authenticated SQL injection vulnerability within its admin log table implementations. The flaw resides in the improper handling of the `orderby` and `order` parameters, which are concatenated into a SQL query without sufficient preparation or validation. This allows an authenticated user with administrative privileges to influence the query logic.\n\n#### Attack Vector Analysis\n*   **Target Sink:** `$wpdb->get_results( $query )`\n*   **Vulnerable Parameters:** `$_GET['orderby']` and `$_GET['order']`\n*   **Entry Point:** The vulnerability is triggered when an administrator views the import or export logs.\n    *   **Import Logs:** `wp-admin\u002Fadmin.php?page=houzez-property-feed-import&tab=logs`\n    *   **Export Logs:** `wp-admin\u002Fadmin.php?page=houzez-property-feed-export&tab=logs`\n*   **Authentication Requirement:** Administrator-level access is required to access the plugin's log pages","The Houzez Property Feed plugin for WordPress is vulnerable to SQL injection because it concatenates the user-supplied 'orderby' and 'order' parameters directly into SQL queries within the logs table implementations. Although the values are passed through sanitize_text_field(), this does not prevent malicious SQL logic from being injected into the ORDER BY clause, which $wpdb->prepare() cannot retroactively secure.","\u002F\u002F includes\u002Fclass-houzez-property-feed-admin-logs-export-table.php (line 205)\n$orderby = (!empty($_GET['orderby'])) ? sanitize_text_field($_GET['orderby']) : 'start_date'; \u002F\u002F default order\n$order = (!empty($_GET['order'])) ? sanitize_text_field($_GET['order']) : 'asc'; \u002F\u002F default order direction\n\n\u002F\u002F ... \n\n$query .= \" ORDER BY $orderby $order\";\n$query .= $wpdb->prepare(\" LIMIT %d OFFSET %d\", $per_page, ($current_page - 1) * $per_page);\n\n---\n\n\u002F\u002F includes\u002Fclass-houzez-property-feed-admin-logs-import-table.php (line 163)\n$orderby = (!empty($_GET['orderby'])) ? sanitize_text_field($_GET['orderby']) : 'start_date'; \u002F\u002F default order\n$order = (!empty($_GET['order'])) ? sanitize_text_field($_GET['order']) : 'asc'; \u002F\u002F default order direction\n\n\u002F\u002F ...\n\n$query .= \" ORDER BY $orderby $order\";\n$query .= $wpdb->prepare(\" LIMIT %d OFFSET %d\", $per_page, ($current_page - 1) * $per_page);","--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fhouzez-property-feed\u002F2.5.46\u002Fincludes\u002Fclass-houzez-property-feed-admin-logs-export-table.php\t2026-03-24 13:59:38.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fhouzez-property-feed\u002F2.5.47\u002Fincludes\u002Fclass-houzez-property-feed-admin-logs-export-table.php\t2026-07-01 09:23:04.000000000 +0000\n@@ -202,8 +218,14 @@\n \n         $totalitems = $wpdb->get_var($query);\n \n-        $orderby = (!empty($_GET['orderby'])) ? sanitize_text_field($_GET['orderby']) : 'start_date'; \u002F\u002F default order\n-        $order = (!empty($_GET['order'])) ? sanitize_text_field($_GET['order']) : 'asc'; \u002F\u002F default order direction\n+        $allowed_orderby = array(\n+            'start_date' => 'start_date',\n+        );\n+        $orderby = (!empty($_GET['orderby'])) ? sanitize_text_field($_GET['orderby']) : 'start_date';\n+        $orderby = isset($allowed_orderby[$orderby]) ? $allowed_orderby[$orderby] : 'start_date';\n+        \n+        $order = !empty($_GET['order']) ? strtoupper(sanitize_key(wp_unslash($_GET['order']))) : 'ASC';\n+        $order = in_array($order, array('ASC', 'DESC'), true) ? $order : 'ASC';\n \n         $query = \"SELECT\n             id, \n@@ -217,7 +239,7 @@\n             $query .= \" WHERE export_id = '\" . $export_id . \"' \";\n         }\n         $query .= \" ORDER BY $orderby $order\";\n-        $query .= $wpdb->prepare(\" LIMIT %d OFFSET %d\", $per_page, ($current_page - 1) * $per_page);\n+        $query .= $wpdb->prepare( \" LIMIT %d OFFSET %d\", absint($per_page), absint(($current_page - 1) * $per_page) );\n \n         $this->items = $wpdb->get_results($query);\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fhouzez-property-feed\u002F2.5.46\u002Fincludes\u002Fclass-houzez-property-feed-admin-logs-import-table.php\t2025-03-13 16:58:22.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fhouzez-property-feed\u002F2.5.47\u002Fincludes\u002Fclass-houzez-property-feed-admin-logs-import-table.php\t2026-07-01 09:23:04.000000000 +0000\n@@ -160,8 +176,14 @@\n \n         $totalitems = $wpdb->get_var($query);\n \n-        $orderby = (!empty($_GET['orderby'])) ? sanitize_text_field($_GET['orderby']) : 'start_date'; \u002F\u002F default order\n-        $order = (!empty($_GET['order'])) ? sanitize_text_field($_GET['order']) : 'asc'; \u002F\u002F default order direction\n+        $allowed_orderby = array(\n+            'start_date' => 'start_date',\n+        );\n+        $orderby = (!empty($_GET['orderby'])) ? sanitize_text_field($_GET['orderby']) : 'start_date';\n+        $orderby = isset($allowed_orderby[$orderby]) ? $allowed_orderby[$orderby] : 'start_date';\n+\n+        $order = !empty($_GET['order']) ? strtoupper(sanitize_key(wp_unslash($_GET['order']))) : 'ASC';\n+        $order = in_array($order, array('ASC', 'DESC'), true) ? $order : 'ASC';\n \n         $query = \"SELECT\n             id, \n@@ -178,7 +200,7 @@\n             $query .= \" WHERE import_id = '\" . (int)$_GET['import_id'] . \"' \";\n         }\n         $query .= \" ORDER BY $orderby $order\";\n-        $query .= $wpdb->prepare(\" LIMIT %d OFFSET %d\", $per_page, ($current_page - 1) * $per_page);\n+        $query .= $wpdb->prepare( \" LIMIT %d OFFSET %d\", absint($per_page), absint(($current_page - 1) * $per_page) );\n \n         $this->items = $wpdb->get_results($query);","To exploit this vulnerability, an attacker must have Administrator-level access to the WordPress dashboard. The attacker navigates to either the Export Logs page (wp-admin\u002Fadmin.php?page=houzez-property-feed-export&tab=logs) or the Import Logs page (wp-admin\u002Fadmin.php?page=houzez-property-feed-import&tab=logs). By appending a malicious payload to the 'orderby' or 'order' GET parameters, the attacker can break out of the ORDER BY clause and execute arbitrary SQL logic. Since the result of the injection is used to sort the data or can be timed (SLEEP), an attacker can use boolean-based or time-based blind SQL injection techniques to extract sensitive information from the WordPress database, such as administrator password hashes.","gemini-3-flash-preview","2026-07-25 11:31:24","2026-07-25 11:32:37",{"type":38,"vulnerable_version":39,"fixed_version":11,"vulnerable_browse":40,"vulnerable_zip":41,"fixed_browse":42,"fixed_zip":43,"all_tags":44},"plugin","2.5.46","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fhouzez-property-feed\u002Ftags\u002F2.5.46","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fhouzez-property-feed.2.5.46.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fhouzez-property-feed\u002Ftags\u002F2.5.47","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fhouzez-property-feed.2.5.47.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fhouzez-property-feed\u002Ftags"]