What is the CVSS score of EUVD-2026-57973?

EUVD-2026-57973 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.3%.

Which versions of Listdom are affected by EUVD-2026-57973?

The Listdom WordPress plugin (Webilia) version 5.6.0 and earlier contains a critical unauthenticated SQL injection vulnerability that allows remote attackers to directly compromise the WordPress…

How to fix or mitigate EUVD-2026-57973?

Within 24 hours: audit all WordPress installations to identify any deployment of Listdom plugin version 5.6.0 or earlier and document current usage. Within 7 days: either remove the plugin entirely or implement Web Application Firewall rules to block SQL injection patterns, restrict database user privileges to minimum necessary access, and enable database query logging. Within 30 days: establish a plugin security assessment process before deployment, conduct user communication if data exposure occurred, and evaluate alternative listing solutions to prevent recurrence.

Listdom EUVD-2026-57973

| CVE-2026-61969 CRITICAL

SQL Injection (CWE-89)

2026-08-13 Patchstack

GHSA-jwwc-mm97-jw9v

WordPress SQLi Wordpress Plugin Listdom Webilia Inc

9.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

8.2 HIGH

Unauthenticated network SQLi warrants AV:N/AC:L/PR:N/UI:N with C:H for database read; I:L for possible limited data manipulation, A:N, and S:U as no cross-component scope change is evidenced.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 14:46 vuln.today

CVE Published

Aug 13, 2026 - 13:36 cve.org

CRITICAL 9.3

DescriptionCVE.org

Unauthenticated SQL Injection in Listdom <= 5.6.0 versions.

AnalysisAI

Unauthenticated SQL injection in the Listdom WordPress plugin (Webilia) through version 5.6.0 lets remote attackers inject arbitrary SQL into backend database queries without any authentication or user interaction. Reported by Patchstack and rated CVSS 9.3, it primarily threatens the confidentiality of the WordPress database (user credentials, session data, private listings). No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

Listdom is a WordPress business-directory / listings plugin developed by Webilia Inc. (CPE cpe:2.3:a:webilia_inc.:listdom). The flaw is a classic CWE-89 SQL Injection: user-controlled input reaches a database query without proper parameterization or use of WordPress's $wpdb->prepare() sanitization, allowing an attacker to break out of the intended query context. Because the vulnerable endpoint is reachable pre-authentication, any unauthenticated visitor can manipulate the underlying MySQL/MariaDB queries that back the plugin's directory features.

RemediationAI

Upgrade Listdom to a release later than 5.6.0 once the vendor publishes a fixed version; the input data does not include an exact patched version number, so consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/listdom/vulnerability/wordpress-listdom-plugin-5-6-0-sql-injection-vulnerability?_s_id=cve) and the WordPress plugin changelog to confirm the corrected build before deploying. Until a confirmed patch is applied, deploy a WAF or WordPress virtual-patch rule (Patchstack's own vPatch covers this CVE) to block SQL-injection payloads against the plugin's endpoints, restrict access to the affected listing/search endpoints, or temporarily deactivate the plugin - with the trade-off that deactivation removes all directory functionality from the site. Ensure database backups exist before any remediation in case data has already been exfiltrated or tampered with.