This vulnerability (CVE-2026-39438) in Emraan Cheema's ListingPro product is an unauthenticated SQL Injection issue classified under CWE-89. It affects all versions up to 2.9.10, allowing attackers to inject malicious SQL commands remotely without any privileges or user interaction. The CVSS 3.1 score of 9.3 reflects a critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and a scope change. The impact is high confidentiality loss and low availability impact, with no integrity impact. There is no vendor advisory or patch available at this time, and no known exploits in the wild have been reported.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database remotely without authentication, leading to potential disclosure of sensitive data (high confidentiality impact) and limited disruption of service (low availability impact). Integrity is not impacted according to the CVSS vector. This poses a critical risk to affected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying workarounds such as restricting access to vulnerable endpoints or deploying web application firewalls with SQL injection protections. Monitor vendor channels for updates and patches.