EUVD-2026-57973
GHSA-jwwc-mm97-jw9v
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Unauthenticated network SQLi warrants AV:N/AC:L/PR:N/UI:N with C:H for database read; I:L for possible limited data manipulation, A:N, and S:U as no cross-component scope change is evidenced.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated SQL Injection in Listdom <= 5.6.0 versions.
AnalysisAI
Unauthenticated SQL injection in the Listdom WordPress plugin (Webilia) through version 5.6.0 lets remote attackers inject arbitrary SQL into backend database queries without any authentication or user interaction. Reported by Patchstack and rated CVSS 9.3, it primarily threatens the confidentiality of the WordPress database (user credentials, session data, private listings). No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Technical ContextAI
Listdom is a WordPress business-directory / listings plugin developed by Webilia Inc. (CPE cpe:2.3:a:webilia_inc.:listdom). The flaw is a classic CWE-89 SQL Injection: user-controlled input reaches a database query without proper parameterization or use of WordPress's $wpdb->prepare() sanitization, allowing an attacker to break out of the intended query context. Because the vulnerable endpoint is reachable pre-authentication, any unauthenticated visitor can manipulate the underlying MySQL/MariaDB queries that back the plugin's directory features.
RemediationAI
Upgrade Listdom to a release later than 5.6.0 once the vendor publishes a fixed version; the input data does not include an exact patched version number, so consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/listdom/vulnerability/wordpress-listdom-plugin-5-6-0-sql-injection-vulnerability?_s_id=cve) and the WordPress plugin changelog to confirm the corrected build before deploying. Until a confirmed patch is applied, deploy a WAF or WordPress virtual-patch rule (Patchstack's own vPatch covers this CVE) to block SQL-injection payloads against the plugin's endpoints, restrict access to the affected listing/search endpoints, or temporarily deactivate the plugin - with the trade-off that deactivation removes all directory functionality from the site. Ensure database backups exist before any remediation in case data has already been exfiltrated or tampered with.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today