⛔ Critical Security Advisory Auto Listings · WordPress.org · 2.7.3 Disclosed 2026-07-11 · 16:30 UTC
Coordinated disclosure — technical detail withheld until 2026-08-25 (45 days). The affected package, version, vulnerability class and remediation are public on this page so defenders can act now. The exact code location, sink and reproduction are held back to limit exploitation until the window closes, then revealed automatically. Vendor notified 2026-07-11.
Advisory · CLR-2026-3031

Unauthenticated SQL Injection in the WordPress plugin Auto Listings (2.7.3)

Auto Listings (WordPress.org, version 2.7.3) Auto Listings (2.7.3) hooks the front-end search query and passes the search parameter through sanitize_text_field() — which strips HTML tags but does not escape SQL — directly into a LIKE clause of a live query. An unauthenticated visitor can inject SQL through the listings search and read arbitrary database contents (WordPress user password hashes, secrets). No fixed release is available.

CriticalSQL InjectionUnauthenticatedWordPressVerified in source
Summary

Auto Listings 2.7.3 (WordPress.org) contains an unauthenticated sql injection. The plugin registers a handler reachable by visitors who are not logged in, and it concatenates a request parameter straight into a live SQL statement.

An unauthenticated front-end query hook passes the search parameter through sanitize_text_field() — which strips HTML tags but performs no SQL escaping — straight into a LIKE clause, so the value reaches the database unescaped. The result is a blind/time-based SQL-injection channel through which the full database (user password hashes, secrets) can be extracted.

Auto Listings was surfaced automatically by the codelake WordPress static-analysis pipeline (source-to-sink taint) · AI false-positive triage · manual source verification, and then verified by hand against the shipped 2.7.3 artifact.

Impact

Class: SQL Injection (CWE-89). Privilege required: none — the injectable endpoint is registered for logged-out visitors. Effect: read access to the entire database via blind SQL injection (credential hashes, secrets, tokens); depending on database privileges, write access.

The precise sink locations and code are withheld below until the disclosure deadline.

Vulnerable code
🔒
Technical detail withheld until 2026-08-25 (45 days). The affected package, version, vulnerability class and remediation are public on this page. The exact code location, sink and reproduction are held back to limit exploitation while the issue is unpatched, and are revealed automatically once the coordinated-disclosure window closes.
Technical detail
🔒
Technical detail withheld until 2026-08-25 (45 days). The affected package, version, vulnerability class and remediation are public on this page. The exact code location, sink and reproduction are held back to limit exploitation while the issue is unpatched, and are revealed automatically once the coordinated-disclosure window closes.
Timeline
2026-07-11
Automatic detection
codelake WordPress static-analysis pipeline (source-to-sink taint) flags a request-to-database taint flow with no prepared statement; AI-triage marks it a real finding.
2026-07-11
Manual verification
Confirmed against the shipped 2.7.3 artifact — unauthenticated reachability verified in source.
2026-07-11
6:30 UTC
WordPress Plugin Security Team notified
Coordinated disclosure opened with full technical detail; a 45-day window begins.
2026-08-25
Technical-detail reveal
The exact code location and reproduction are published automatically after the 45-day window.
Indicators & characteristics
PKGAuto Listings 2.7.3 (WordPress.org) — wordpress.org/plugins/auto-listings
SHA256cd959ced385f5246fea52d261c51314188c4fb5d4d805f61a5cfa54a1e791087 (artifact)
CLASSCWE-89 SQL Injection · sanitize_text_field() used as an (ineffective) SQL neutraliser
AUTHZNo authentication required · no nonce · no capability check
🔒SINK — withheld until 2026-08-25
🔒ENTRY — withheld until 2026-08-25
Remediation
#ActionPriority
01 Update to a fixed release once the vendor ships one; until then, deactivate Auto Listings. Critical
02 Patch: replace every concatenated query with $wpdb->prepare() and typed placeholders (%d/%s). High
03 Add nonce + capability checks (check_ajax_referer(), current_user_can()) to state-changing AJAX handlers and remove any unintended nopriv registration. High
04 Check access logs for requests with SQL metacharacters in parameters during the exposure window. Recommended

Detected by codelake Research · codelake WordPress static-analysis pipeline (source-to-sink taint) · AI false-positive triage · manual source verification · disclosed to WordPress Plugin Security Team before publication.

This is a coordinated vulnerability disclosure. The affected package, version and class are published immediately so defenders can act; the exact code location and reproduction are withheld until the deadline, and no weaponised proof-of-concept is published. The archived artifact is available to verified security researchers on request.