What is the CVSS score of CVE-2026-54819?

CVE-2026-54819 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.2%.

Which versions of Listdom are affected by CVE-2026-54819?

Webilia's Listdom WordPress plugin (versions ≤ 5.4.0) contains a critical blind SQL injection vulnerability (CVSS 9.3) enabling unauthenticated attackers to extract sensitive database information…

How to fix or mitigate CVE-2026-54819?

Within 24 hours: Conduct a complete inventory of WordPress instances; identify all running Webilia Listdom versions 5.4.0 or earlier and classify by data sensitivity. Within 7 days: Remove Webilia Listdom plugin version 5.4.0 or earlier from all WordPress installations; if operationally critical, isolate affected systems from untrusted networks and restrict database access to whitelisted IPs. Within 30 days: Establish a monitoring process for Webilia security advisories and plugin repository updates; implement a security review gate before deploying any plugin updates.

Listdom CVE-2026-54819

CRITICAL

SQL Injection (CWE-89)

2026-06-17 Patchstack

WordPress SQLi Wordpress Plugin Listdom Webilia Inc

9.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

8.6 HIGH

Remote unauthenticated blind SQLi in a WordPress plugin reaches the shared core DB (S:C, C:H); blind read-only nature makes integrity and availability impact negligible (I:N/A:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 14:23 vuln.today

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Webilia Inc. Listdom allows Blind SQL Injection.

This issue affects Listdom: from n/a through 5.4.0.

AnalysisAI

Blind SQL injection in Webilia's Listdom WordPress plugin (versions up to and including 5.4.0) allows remote unauthenticated attackers to inject SQL fragments into back-end queries and extract data inferentially. The flaw carries a 9.3 CVSS score with a scope change (S:C), indicating the injection can affect resources beyond the vulnerable component. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

Listdom is a WordPress directory/listing plugin developed by Webilia Inc. that ships custom database queries for filtering, searching, and displaying listings. The root cause is CWE-89 - user-supplied input is concatenated into an SQL statement without proper parameterization or escaping via $wpdb->prepare(). Because the bug is blind, the attacker infers data via boolean/time-based responses rather than reflected output. The CPE cpe:2.3:a:webilia_inc.:listdom:*:*:*:*:*:*:*:* confirms all distributions of the plugin up to 5.4.0 are in scope.

RemediationAI

Upgrade Listdom to a version newer than 5.4.0 once Webilia publishes a fixed release; the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/listdom/vulnerability/wordpress-listdom-plugin-5-4-0-sql-injection-vulnerability should be monitored for the exact patched version, as no specific fix version was provided in the supplied intelligence. Until a vendor patch is confirmed, deactivate and remove the Listdom plugin (the cleanest mitigation, at the cost of losing directory functionality), or place the site behind a WAF with WordPress-aware SQLi rulesets such as Patchstack mitigation, Wordfence, or Cloudflare Managed Rules - noting that blind SQLi via legitimate-looking parameters can evade generic signatures. As a defense-in-depth step, ensure the WordPress database user has no privileges beyond the single WP database and rotate any secrets stored in wp_options if exploitation is suspected.