CVE-2026-13357: Houzez Property Feed SQL Injection Flaw

CVE-2026-13357 Overview

CVE-2026-13357 is a SQL injection vulnerability in the Houzez Property Feed plugin for WordPress affecting all versions up to and including 2.5.46. The flaw resides in the prepare_items() method of the Houzez_Property_Feed_Admin_Logs_Export_Table and Houzez_Property_Feed_Admin_Logs_Import_Table classes. User-controlled values from $_GET['orderby'] and $_GET['order'] are sanitized only with sanitize_text_field() and concatenated into the SQL query before $wpdb->prepare() is called. Authenticated attackers with Administrator-level access can append additional SQL statements to extract sensitive data from the WordPress database. The vulnerability is classified under CWE-89.

Critical Impact
Authenticated administrators can inject arbitrary SQL through the orderby and order parameters, enabling exfiltration of confidential database contents including user credentials and site configuration.

Affected Products

Houzez Property Feed plugin for WordPress — all versions up to and including 2.5.46
WordPress sites using the Houzez_Property_Feed_Admin_Logs_Export_Table class
WordPress sites using the Houzez_Property_Feed_Admin_Logs_Import_Table class

Discovery Timeline

2026-07-02 - CVE-2026-13357 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-13357

Vulnerability Analysis

The vulnerability is a classic ORDER BY SQL injection in a WordPress admin table implementation. The affected prepare_items() methods build SQL queries by directly concatenating the orderby and order request parameters into the query string. sanitize_text_field() strips tags and normalizes whitespace but performs no SQL-specific escaping, so SQL metacharacters and keywords pass through unchanged.

After concatenation, the code calls $wpdb->prepare() on the resulting string. However, prepare() only parameterizes placeholders bound to the LIMIT and OFFSET clauses appended afterward. It cannot retroactively neutralize the tainted ORDER BY clause that has already been assembled into the format string. The result is a fully controllable injection point despite the presence of a prepare call.

Exploitation requires Administrator privileges, which raises the bar but does not eliminate risk. Compromised admin accounts, insider threats, and multi-tenant hosting environments remain viable attack scenarios. Successful exploitation returns database content — including hashed credentials, session tokens, and secret keys stored in wp_options — through UNION-based or error-based techniques.

Root Cause

The root cause is misuse of $wpdb->prepare(). Placeholders are effective only for values inserted at prepare time, not for identifiers such as column names or SQL keywords like ASC/DESC. The plugin author treated sanitize_text_field() as sufficient for the ORDER BY portion, leaving the query construction vulnerable to injection through the orderby and order GET parameters.

Attack Vector

An authenticated administrator issues a crafted HTTP GET request to the plugin's admin log export or import screen with malicious payloads in the orderby and order parameters. The injected SQL fragments extend the ORDER BY clause with subqueries, CASE expressions, or time-based blind techniques to enumerate database rows. Refer to the Wordfence Vulnerability Report and the WordPress Plugin Code Snippet for the vulnerable source lines.

Detection Methods for CVE-2026-13357

Indicators of Compromise

Admin-area HTTP GET requests to plugin log pages containing SQL keywords in orderby or order parameters, such as CASE, UNION, SELECT, SLEEP(, or backticks.
Unusually long or URL-encoded values for the orderby or order query string parameters.
Web server access logs showing repeated requests to admin.php referencing the Houzez Property Feed log export or import screens.
Database error entries referencing malformed ORDER BY clauses originating from the plugin.

Detection Strategies

Inspect WordPress access logs for GET requests to Houzez Property Feed admin pages with non-alphanumeric characters in orderby or order.
Deploy web application firewall (WAF) rules that flag SQL syntax in ORDER BY parameters on WordPress admin routes.
Enable MySQL general or slow query logging and search for queries containing ORDER BY clauses with subqueries or conditional expressions issued by the plugin.
Monitor administrator session activity for anomalous access patterns to plugin log pages.

Monitoring Recommendations

Alert on database read spikes correlated with admin sessions hitting the Houzez Property Feed log export or import endpoints.
Track newly created or modified WordPress administrator accounts, which are the precondition for exploitation.
Forward WordPress, PHP, and MySQL logs to a centralized SIEM for correlation with authentication events.

How to Mitigate CVE-2026-13357

Immediate Actions Required

Update the Houzez Property Feed plugin to a version released after 2.5.46 that addresses this issue, per the WordPress Plugin Changeset.
Audit all WordPress administrator accounts and remove or disable those that are unnecessary.
Enforce multi-factor authentication for every administrator account to limit exposure of the privileged attack surface.
Rotate database credentials and WordPress secret keys if unauthorized administrator activity is suspected.

Patch Information

The vendor addressed this issue via the plugin changeset referenced in the WordPress Plugin Changeset. Site owners running Houzez Property Feed 2.5.46 or earlier should apply the fixed release. Details on the vulnerable code paths are available in the Wordfence Vulnerability Report.

Workarounds

Deactivate the Houzez Property Feed plugin until the patched version can be installed.
Restrict access to /wp-admin/ by IP allowlisting at the web server or WAF layer.
Deploy WAF signatures that block SQL keywords in the orderby and order query string parameters on WordPress admin routes.
Apply the principle of least privilege by minimizing the number of accounts assigned the Administrator role.