What is the CVSS score of CVE-2026-49063?

CVE-2026-49063 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Listdom are affected by CVE-2026-49063?

The Listdom WordPress directory plugin exposes organizations to unauthorized administrative access: attackers can escalate privileges without authentication on affected sites running versions 5.5.0…

How to fix or mitigate CVE-2026-49063?

Within 24 hours: Identify all WordPress instances running Listdom plugin versions 5.5.0 and earlier and document affected sites by criticality. Within 7 days: Implement immediate mitigation-either deactivate and remove the plugin or restrict access to plugin endpoints via WAF rules and IP-based access controls limiting traffic to trusted administrative networks. Within 30 days: Monitor vendor advisories for patch availability, evaluate alternative directory solutions, and conduct account privilege audits on potentially affected systems.

Listdom CVE-2026-49063

EUVD-2026-36871 HIGH

Incorrect Privilege Assignment (CWE-266)

2026-06-15 Patchstack

GHSA-g5vj-vrxx-7p65

WordPress Privilege Escalation Wordpress Plugin Listdom Webilia Inc

7.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

vuln.today AI

9.8 CRITICAL

Unauthenticated network-reachable privilege escalation in WordPress typically yields administrator capability, which is full site compromise - justifying C:H/I:H/A:H rather than the conservative L/L/L in the supplied vector.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 21:40 vuln.today

DescriptionCVE.org

Unauthenticated Privilege Escalation in Listdom <= 5.5.0 versions.

AnalysisAI

Unauthenticated privilege escalation in the Listdom WordPress plugin versions 5.5.0 and earlier allows remote attackers to elevate privileges without any authentication or user interaction. The flaw is tracked under CWE-266 (Incorrect Privilege Assignment) and was reported by Patchstack; no public exploit identified at time of analysis. Affected sites running this Webilia-developed directory listing plugin face risk of unauthorized account or capability elevation through exposed plugin endpoints.

Technical ContextAI

Listdom is a WordPress directory and listing plugin published by Webilia Inc. (CPE cpe:2.3:a:webilia_inc.:listdom). The root cause is classified as CWE-266 (Incorrect Privilege Assignment), a weakness class where the application grants a user privileges that exceed those intended for their role - typically because a plugin-exposed action, AJAX handler, or REST endpoint fails to verify the caller's capability before assigning roles, modifying user meta, or performing privileged operations. In the WordPress plugin ecosystem this commonly manifests as nonce/capability checks being absent on hooks reachable by anonymous visitors, allowing unprivileged callers to invoke logic intended for administrators.

RemediationAI

Upstream fix available per Patchstack advisory; released patched version not independently confirmed from the supplied data - administrators should check the Listdom plugin page on wordpress.org and the vendor changelog for a release later than 5.5.0 and upgrade immediately, consulting https://patchstack.com/database/wordpress/plugin/listdom/vulnerability/wordpress-listdom-plugin-5-5-0-privilege-escalation-vulnerability for advisory details. Until a confirmed fixed version is installed, compensating controls include deactivating the Listdom plugin entirely (trade-off: directory/listing pages will be unavailable), restricting access to wp-admin/admin-ajax.php and the WP REST API for Listdom routes via a WAF rule or virtual patch (trade-off: legitimate front-end calls into Listdom AJAX handlers may break and require allowlisting), and auditing the wp_users and wp_usermeta tables for unexpected role assignments or new administrator accounts created since the plugin was installed.