⛔ Critical Security Advisory Auto Listings · WordPress.org · 2.7.3 Disclosed 2026-07-11 · 16:30 UTC

Full technical detail published. The 45-day coordinated-disclosure window (vendor notified 2026-07-11) has passed; the exact code location and analysis are shown below. No weaponised exploit is published.

Advisory · CLR-2026-3031

Unauthenticated SQL Injection in the WordPress plugin Auto Listings (2.7.3)

Auto Listings (WordPress.org, version 2.7.3) Auto Listings (2.7.3) hooks the front-end search query and passes the search parameter through sanitize_text_field() — which strips HTML tags but does not escape SQL — directly into a LIKE clause of a live query. An unauthenticated visitor can inject SQL through the listings search and read arbitrary database contents (WordPress user password hashes, secrets). No fixed release is available.

CriticalSQL InjectionUnauthenticatedWordPressVerified in source

Summary

Auto Listings 2.7.3 (WordPress.org) contains an unauthenticated sql injection. The plugin registers a handler reachable by visitors who are not logged in, and it concatenates a request parameter straight into a live SQL statement.

An unauthenticated front-end query hook passes the search parameter through sanitize_text_field() — which strips HTML tags but performs no SQL escaping — straight into a LIKE clause, so the value reaches the database unescaped. The result is a blind/time-based SQL-injection channel through which the full database (user password hashes, secrets) can be extracted.

Auto Listings was surfaced automatically by the codelake WordPress static-analysis pipeline (source-to-sink taint) · AI false-positive triage · manual source verification, and then verified by hand against the shipped 2.7.3 artifact.

Impact

Class: SQL Injection (CWE-89). Privilege required: none — the injectable endpoint is registered for logged-out visitors. Effect: read access to the entire database via blind SQL injection (credential hashes, secrets, tokens); depending on database privileges, write access.

The precise sink locations and code are withheld below until the disclosure deadline.

Vulnerable code

 auto-listings/src/SearchQuery.php ⛔ unauthenticated sql injection 
18add_action('pre_get_posts', [$this, 'pre_get_posts']);   // front-end query hook
27if (is_admin() || !$query->is_main_query() || !$query->is_post_type_archive('auto-listing') || !$query->is_search()) return;
61if (!empty($_GET['s'])) {
66  $title = sanitize_text_field(strtolower($_GET['s'])); // NOT SQL-escaped
67  $ids = $wpdb->get_col("SELECT ID FROM $wpdb->posts WHERE LOWER(post_title) LIKE '%$title%' AND post_type='auto-listing' AND post_status='publish'");
  }

Technical detail

Because the action carries the wp_ajax_nopriv_ prefix it is reachable without a session. The tainted value lands in the query with no parameterisation.

Further unparameterised queries: sanitize_text_field strips HTML but not SQL metacharacters; strtolower does not neutralise it either (SQL keywords are case-insensitive).

A working proof-of-concept is intentionally not published; the exact reproduction was shared privately with WordPress Plugin Security Team.

Timeline

2026-07-11

Automatic detection

codelake WordPress static-analysis pipeline (source-to-sink taint) flags a request-to-database taint flow with no prepared statement; AI-triage marks it a real finding.

2026-07-11

Manual verification

Confirmed against the shipped 2.7.3 artifact — unauthenticated reachability verified in source.

2026-07-11
6:30 UTC

WordPress Plugin Security Team notified

Coordinated disclosure opened with full technical detail; a 45-day window begins.

2026-08-25

Technical-detail reveal

The exact code location and reproduction are published automatically after the 45-day window.

Indicators & characteristics

PKGAuto Listings 2.7.3 (WordPress.org) — wordpress.org/plugins/auto-listings

SHA256cd959ced385f5246fea52d261c51314188c4fb5d4d805f61a5cfa54a1e791087 (artifact)

CLASSCWE-89 SQL Injection · sanitize_text_field() used as an (ineffective) SQL neutraliser

AUTHZNo authentication required · no nonce · no capability check

SINKexact file:line of the injectable sink

ENTRYexact endpoint / action name

Remediation

#	Action	Priority
01	Update to a fixed release once the vendor ships one; until then, deactivate Auto Listings.	Critical
02	Patch: replace every concatenated query with `$wpdb->prepare()` and typed placeholders (`%d`/`%s`).	High
03	Add nonce + capability checks (`check_ajax_referer()`, `current_user_can()`) to state-changing AJAX handlers and remove any unintended `nopriv` registration.	High
04	Check access logs for requests with SQL metacharacters in parameters during the exposure window.	Recommended

Detected by codelake Research · codelake WordPress static-analysis pipeline (source-to-sink taint) · AI false-positive triage · manual source verification · disclosed to WordPress Plugin Security Team before publication.

This is a coordinated vulnerability disclosure. The affected package, version and class are published immediately so defenders can act; the exact code location and reproduction are withheld until the deadline, and no weaponised proof-of-concept is published. The archived artifact is available to verified security researchers on request.