Description

Unauthenticated SQL Injection in Listdom <= 5.6.0 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.3",
  "pubDate": "2026-08-13T14:17:03.080Z",
  "pubdate": "2026-08-13T14:17:03.080Z",
  "executiveSummary": "An unauthenticated SQL injection vulnerability has been identified in the Listdom plugin up to version 5.6.0. This security flaw allows remote, unauthenticated attackers to manipulate SQL queries by injecting malicious payloads into vulnerable input parameters processed by the application. Successful exploitation of this vulnerability can lead to unauthorized access to the underlying database, enabling threat actors to extract sensitive information, bypass authentication mechanisms, modify application data, or potentially execute administrative operations depending on the database user privileges. The presence of this vulnerability in an unauthenticated context significantly elevates the risk profile, as it lowers the barrier to entry for malicious actors scanning for exposed WordPress plugins. The root cause stems from insufficient input sanitization and lack of proper parameterization within database query constructions. Remediation requires updating the Listdom plugin to a patched version beyond 5.6.0 or applying vendor-supplied security patches. Organizations utilizing affected versions face high operational and data security risks until appropriate mitigations are implemented.",
  "technicalDetails": "The vulnerability resides within the Listdom plugin version 5.6.0 and prior, specifically within database interaction components that fail to adequately sanitize or parameterize user-supplied input before incorporating it into SQL statements. SQL injection occurs when untrusted data is concatenated directly into database queries, allowing the parser to interpret the input as executable SQL commands rather than static data.\nAttackers can exploit this flaw without authentication by interacting with exposed endpoints or parameters handled by the vulnerable component over the network. The attack flow typically begins with the adversary identifying an input vector that lacks proper input validation or prepared statements. By crafting a specialized HTTP request containing malicious SQL syntax (such as UNION-based operators, boolean-based conditional injections, or time-based blind payloads), the attacker forces the database management system to execute unintended queries.\nBecause the vulnerability is unauthenticated, no valid session, user credentials, or administrative privileges are required to initiate the attack. The network exposure is public-facing, meaning any remote actor with access to the web application can deliver the payload. Upon successful execution, the injected SQL commands execute within the context of the database user account configured for the web application. Depending on database configurations, this may result in the complete extraction of sensitive tables, including user credentials, configuration data, and proprietary content stored within the WordPress database. Post-exploitation impact can escalate if the database user possesses excessive privileges, potentially granting the attacker capabilities to interact with the underlying operating system or pivot further into the internal network infrastructure."
}