CVE-2026-13357 is an SQL Injection vulnerability in the Houzez Property Feed WordPress plugin affecting all versions up to 2.5.46. The flaw exists in the prepare_items() method of the Houzez_Property_Feed_Admin_Logs_Export_Table and Houzez_Property_Feed_Admin_Logs_Import_Table classes, where the 'orderby' and 'order' GET parameters are sanitized only with sanitize_text_field() and then concatenated into an SQL query string. The $wpdb->prepare() function is used only for the LIMIT/OFFSET clause and does not secure the ORDER BY clause, allowing authenticated administrators to inject arbitrary SQL commands. This can lead to unauthorized disclosure of sensitive database information.

An attacker with administrator-level privileges can exploit this vulnerability to perform SQL Injection attacks, potentially extracting sensitive information from the database. The vulnerability does not affect confidentiality, integrity, or availability beyond data disclosure. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrator access to trusted users only. Avoid using the vulnerable 'orderby' parameter or apply custom input validation and sanitization to prevent injection. Monitor official Propertyhive communications for updates and patches.