Listdom CVE-2026-49063

No special conditions - remote unauthenticated exploitation against default configurations of the Listdom WordPress plugin at version 5.5.0 or earlier (CVSS AV:N/AC:L/PR:N/UI:N). The only prerequisites are that the target WordPress site has the Listdom plugin installed and activated at an affected version and that the vulnerable endpoint (admin-ajax.php or the plugin's REST routes) is reachable from the attacker's network position; no authenticated session, no administrator interaction, and no non-default plugin settings are required. Exploitation is limited to sites running this specific plugin, so the population is bounded by Listdom's install base rather than all WordPress sites.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L yields 7.3 (High) and indicates a network-reachable, low-complexity, unauthenticated, no-user-interaction flaw with partial impact across confidentiality, integrity, and availability - consistent with a privilege escalation against a single WordPress site. Patchstack listed the issue, but it is not present in CISA KEV and no EPSS score, SSVC decision, or public POC was supplied with the intelligence package, so exploitation is currently unconfirmed in the wild. The mismatch worth flagging: the C/I/A:L scoring is somewhat conservative for a privilege escalation issue - successful elevation to administrator on WordPress typically yields full site compromise (which would justify C/I/A:H), so defenders should treat the practical impact as higher than the 7.3 base score suggests, especially given the plugin is reachable over the network without authentication.

An unauthenticated attacker on the internet sends a crafted HTTP request to a vulnerable Listdom endpoint on a target WordPress site - for example an admin-ajax.php or REST route exposed by the plugin - that performs a privileged action without verifying the caller's capability, causing the attacker's session or a new account to be granted elevated WordPress privileges. With elevated privileges the attacker can pivot to full site takeover by uploading a malicious theme/plugin or modifying site options. No public exploit identified at time of analysis, but the low attack complexity makes weaponization straightforward once the vulnerable endpoint is identified.