The vulnerability is a classic SQL injection within the subscriber interface of ListingPro version 2.9.12 and earlier. By submitting specially crafted input, an attacker can inject arbitrary SQL statements into the backend database. The effect is a compromise of data confidentiality and integrity, potentially allowing data exfiltration, manipulation, or credential theft. The weakness is classified as CWE‑89.

WordPress users running the ListingPro plugin from CridioStudio, specifically versions 2.9.12 and prior. These installations expose a public subscriber form that is reachable on the WordPress site.

The CVSS score of 8.5 indicates high severity. The EPSS score of less than 1% indicates a very low probability of exploitation, but the lack of a KEV listing does not negate the risk; an attacker could still target the publicly exposed subscriber endpoint. The likely attack vector is through the normal subscriber submission page, requiring no elevated privileges. If exploited, attacker control over database queries could lead to further compromise of the site.