The Houzez Property Feed vulnerable to an authenticated SQL injection flaw that arises from insufficient escaping of the 'orderby' and 'order' query parameters in the these values are sanitized only with a basic text filter and then placed directly into an ORDER BY clause before the statement is prepared, an attacker with Administrator-level permissions can append malicious SQL and retrieve arbitrary data from the database. The weakness corresponds to CWE‑89, which can enable attackers to read or modify sensitive information.

All WordPress sites that use the Houzez Property Feed plugin supplied by PropertyHive, version 2.5.46 and earlier, are affected by this vulnerability. Any installation of these plugin releases that includes the admin import or export features exposes the order and orderby parameters to potential exploitation by users with Administrator or higher privileges.

The CVSS score of 4.9 places the vulnerability in the lower‑moderate severity range. The EPSS score of < 1% indicates a very low probability of exploitation at the time of analysis. The flaw requires the attacker to be an Administrator on the target site, which limits the‑in users with high privileges. Once accessed, the attacker can append malicious SQL to retrieve arbitrary data from the database, providing full read access to confidential information. The vulnerability is not listed in the CISA KEV catalog, suggesting that no widespread public exploits are known, but the presence of an authenticated SQL injection remains a serious confidentiality risk for compromised accounts.