Listdom CVE-2026-104722

Requires an authenticated WordPress account at administrator level or above (CVSS PR:H) on a site running the Listdom plugin version 6.1.2 or earlier, and requires use of the plugin's CSV import feature (LSD_Menus_IX_CSV::import), which performs insufficient file-path validation. The attacker supplies a traversal path to delete an arbitrary server file; escalation to RCE specifically depends on deleting a sensitive file such as wp-config.php to force WordPress into a re-installation/takeover state. The key limiting factor is the administrator privilege requirement, which confines realistic exploitation to compromised/malicious admins or multi-admin environments; there is no user-interaction or non-default-configuration barrier beyond having the plugin installed and the import feature accessible.

This is a medium-severity, high-barrier issue rather than a widespread emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N, base 4.9) is the dominant signal: PR:H means the attacker must ALREADY hold WordPress administrator-level access, so this is a post-authentication primitive for an already-privileged actor, not a pre-auth mass-exploitation bug. No EPSS score, no CISA KEV listing, and no POC were supplied, so exploitation status is: no public exploit identified at time of analysis - real-world risk is correspondingly limited to scenarios where an admin account is compromised, shared, or malicious. The input vector scores C:H/I:N/A:N, which is internally inconsistent for an ARBITRARY FILE DELETION flaw - deletion is fundamentally an integrity/availability impact, not confidentiality; the C:H appears to reflect the downstream wp-config.php-deletion-to-site-takeover chain rather than the direct primitive. VERIFY this scoring with the vendor/Wordfence. No SSVC data was provided. Bottom line: a genuine RCE-capable flaw, but gated behind administrator privileges and with no evidence of active or automated exploitation, so it ranks below pre-auth criticals in patch prioritization.

An attacker who has obtained WordPress administrator access (via compromised credentials, a second-order privilege escalation, or a rogue co-admin) uses the Listdom plugin's CSV import feature to submit a crafted, path-traversing file path. By deleting wp-config.php they force WordPress into its setup/installation state, allowing them to re-point the site to an attacker-controlled database and ultimately achieve remote code execution. No public exploit code was identified at time of analysis.