What is the CVSS score of CVE-2026-54819?

CVE-2026-54819 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.2%.

How to fix or mitigate CVE-2026-54819?

Within 24 hours: Conduct a complete inventory of WordPress instances; identify all running Webilia Listdom versions 5.4.0 or earlier and classify by data sensitivity. Within 7 days: Remove Webilia Listdom plugin version 5.4.0 or earlier from all WordPress installations; if operationally critical, isolate affected systems from untrusted networks and restrict database access to whitelisted IPs. Within 30 days: Establish a monitoring process for Webilia security advisories and plugin repository updates; implement a security review gate before deploying any plugin updates.

Listdom CVE-2026-54819

CRITICAL

SQL Injection (CWE-89)

2026-06-17 Patchstack

WordPress SQLi Wordpress Plugin Listdom Webilia Inc

9.3

CVSS 3.1 · Vendor: Patchstack

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Identify WordPress site running Listdom ≤5.4.0
Delivery

Locate vulnerable plugin parameter
Exploit

Inject blind SQL payload
Execution

Infer database contents via timing/boolean
Persist

Extract admin hashes and secrets
Impact

Pivot to full site compromise

Vulnerability Assessment

Weakness	CWE CWE-89 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization Parameterized queries, prepared statements MITRE ATT&CK 2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Target site must have the Listdom plugin installed and activated at version 5.4.0 or earlier, with at least one vulnerable plugin endpoint reachable to anonymous web visitors (consistent with the typical front-end listing/search pages Listdom exposes). No authentication, no user interaction, and no non-default configuration are required (CVSS PR:N/UI:N). Practical limits: exploitation is blind, so data extraction is slow and may be throttled or detected by WAFs and rate-limiters; and a site that has the plugin installed but the front-end listing pages disabled or behind authentication would narrow exposure.
Impact	Signals are mixed-but-leaning-serious. The CVSS vector AV:N/AC:L/PR:N/UI:N indicates trivial remote unauthenticated reachability, and the S:C scope change explains the elevated 9.3 score despite I:N/A:L - implying the injected SQL can reach the WordPress core database (users, options, secrets) beyond the plugin's own data. Patchstack - a credible WordPress vulnerability disclosure source - is the only intelligence source, and no EPSS, KEV, SSVC, or POC data was supplied; absence of those signals is not evidence of low real-world risk for WordPress plugins, where mass-scanning of disclosed Patchstack advisories is routine within days of publication. Treat this as a high-priority patch for any site running Listdom, but note that EPSS/POC status is genuinely unknown from the provided data.
Exploit ScenarioDerived	An unauthenticated attacker discovers a WordPress site running Listdom ≤5.4.0, identifies a vulnerable listing/search/filter endpoint exposed by the plugin, and submits crafted parameter values containing time-based or boolean SQL payloads. Through inferential responses, they enumerate the wp_users table to extract administrator password hashes and any sensitive data stored in wp_options, then attempt offline cracking or use the data to pivot to site takeover.

Act Now Prioritize within 24-48h. Why: CRITICAL severity.

No patch listed yet 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 17, 2026

Blind SQL injection in Webilia's Listdom WordPress plugin (versions up to and including 5.4.0) allows remote unauthenticated attackers to inject SQL fragments into back-end queries and extract data inferentially. The flaw carries a 9.3 CVSS score with a scope change (S:C), indicating the injection can affect resources beyond the vulnerable component. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

RemediationAI

Upgrade Listdom to a version newer than 5.4.0 once Webilia publishes a fixed release; the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/listdom/vulnerability/wordpress-listdom-plugin-5-4-0-sql-injection-vulnerability should be monitored for the exact patched version, as no specific fix version was provided in the supplied intelligence. Until a vendor patch is confirmed, deactivate and remove the Listdom plugin (the cleanest mitigation, at the cost of losing directory functionality), or place the site behind a WAF with WordPress-aware SQLi rulesets such as Patchstack mitigation, Wordfence, or Cloudflare Managed Rules - noting that blind SQLi via legitimate-looking parameters can evade generic signatures. As a defense-in-depth step, ensure the WordPress database user has no privileges beyond the single WP database and rotate any secrets stored in wp_options if exploitation is suspected.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Listdom is a WordPress directory/listing plugin developed by Webilia Inc. that ships custom database queries for filtering, searching, and displaying listings. The root cause is CWE-89 - user-supplied input is concatenated into an SQL statement without proper parameterization or escaping via $wpdb->prepare(). Because the bug is blind, the attacker infers data via boolean/time-based responses rather than reflected output. The CPE cpe:2.3:a:webilia_inc.:listdom:*:*:*:*:*:*:*:* confirms all distributions of the plugin up to 5.4.0 are in scope.

Know when Listdom gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Patchstack) PRIMARY 9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

vuln.today AI 8.6 HIGH

Remote unauthenticated blind SQLi in a WordPress plugin reaches the shared core DB (S:C, C:H); blind read-only nature makes integrity and availability impact negligible (I:N/A:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Webilia Inc. Listdom allows Blind SQL Injection.

This issue affects Listdom: from n/a through 5.4.0.

Executive ViewAI

Why It Matters

Webilia's Listdom WordPress plugin (versions ≤ 5.4.0) contains a critical blind SQL injection vulnerability (CVSS 9.3) enabling unauthenticated attackers to extract sensitive database information from affected WordPress installations. Any organization using this plugin faces immediate risk of data compromise, including exposure of customer records, credentials, and confidential business information stored in WordPress databases. The vulnerability's scope change rating indicates the attack impact extends beyond the plugin to underlying database infrastructure, affecting the integrity and confidentiality of the entire WordPress environment.

Business Impact: Severe

Compensating Controls

No vendor-released patch identified at time of analysis. Interim compensating controls: (1) Remove or deactivate the plugin immediately if not business-critical; (2) Enforce network segmentation restricting WordPress and database access to trusted IP ranges; (3) Deploy Web Application Firewall rules to detect and block SQL injection patterns in HTTP requests; (4) Implement database activity monitoring and alerting for suspicious query execution; (5) Apply least-privilege principles to WordPress database service accounts, limiting query scope and data access.

Threat Intelligence Overview

EPSS Score

0.2%

Top 86% exploitable

Data Quality

4 sources

Confidence: Medium

NVD

CVE.org

EPSS

Vulnrichment

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 0.2%

Patch available No

Active threat No

Deciding rule

CRITICAL severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.