Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.9

Listdom plugin allows admin to delete any server file

CVE-2026-104722 · published 25 days ago
Summary

The Listdom business directory plugin for WordPress lets anyone with admin-level access delete any file on the web server because it does not properly check the file path you give it. Deleting critical files such as the site’s configuration can let an attacker take control of the site. Apply the vendor’s update or remove the plugin if you cannot upgrade, and limit admin accounts to trusted users.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
webilia listdom: ai-powered business directory with classifieds ads listings <= 6.1.2
Original advisory text
Listdom: AI-powered Business Directory with Classifieds Ads Listings <= 6.1.2 - Authenticated (Administrator+) Path Traversal to Arbitrary File Deletion via 'ix[file]' Parameter
The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the LSD_Menus_IX_CSV::import function in all versions up to, and including, 6.1.2 This makes it possible for authenticated attackers, with administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
4.9 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-22Path Traversal
Timeline
Published10 Oct 2026
Updated4 Nov 2026
First seen10 Oct 2026
Sources
CVE-2026-104722 · NVD
CVE-2026-104722 · MITRE
Track software like this
Free during beta