Listdom EUVD-2026-57973

No special conditions beyond having the Listdom plugin (version 5.6.0 or earlier) installed and active on a reachable WordPress site - the CVSS vector AV:N/AC:L/PR:N/UI:N indicates remote, unauthenticated exploitation with no user interaction against default deployments. The primary limiting factor is simply that the target must be running a vulnerable Listdom version; the specific injectable parameter/endpoint is not disclosed in the provided data and would need to be identified from the Patchstack advisory to build a working request.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L, score 9.3) indicates a network-reachable, low-complexity, unauthenticated attack - the highest-priority exploitation profile. However, no EPSS score, KEV listing, POC, or SSVC data was supplied, so real-world exploitation pressure cannot be quantified from the input. The signals are somewhat internally inconsistent: a scope change (S:C) plus C:H/I:N/A:L is an unusual SQLi rating (SQLi typically yields high confidentiality and often integrity impact rather than availability), suggesting the vendor scored a specific limited-read sink - verify exact impact with the Patchstack advisory. Net: treat as high priority for any site running Listdom because unauthenticated SQLi is trivially automatable once a POC surfaces, but note that active exploitation is not confirmed.

An unauthenticated attacker sends a crafted HTTP request to a vulnerable Listdom endpoint, injecting SQL into a parameter that is concatenated into a backend query. This lets them enumerate and dump database contents - such as WordPress user records and password hashes - enabling follow-on credential cracking and site takeover. No public exploit code has been identified yet, but the low attack complexity makes weaponization straightforward once details circulate.