WordPress Plugin Vulnerabilities

Listdom < 5.6.0 - Unauthenticated Privilege Escalation

Description

The plugin does not prevent unauthenticated users from escalating their privileges, in all versions up to and including 5.5.0.

Affects Plugins

Plugin icon
listdom
Fixed in 5.6.0

References

CVE
CVE-2026-49063
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/dbadc2e6-38fa-47f8-9d8b-79fb867f1003

Classification

Type
PRIVESC
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-269
CVSS
9.8 (critical)

Miscellaneous

Original Researcher
dodoh4t
Verified
No
WPVDB ID
4b6aad60-4cb2-4200-9ffa-a5c5a05df437

Timeline

Publicly Published
2026-06-08 (about 3 months ago)
Added
2026-06-18 (about 3 months ago)
Last Updated
2026-09-15 (about 5 days ago)

Other

Published
Title
Published
2025-11-10
Title
EasyCommerce – AI-Powered, Blazing-Fast & Beautiful WordPress Ecommerce Plugin 0.9.0-beta2 - 1.8.2 - Unauthenticated Privilege Escalation
Published
2024-01-16
Title
SalesKing < 1.6.30 - Unauthenticated Privilege Escalation
Published
2021-02-24
Title
Woocommerce Customers Manager < 26.5 - Arbitrary Account Creation/Update by Low Privilege Users
Published
2025-02-28
Title
Nokri < 1.6.3 - Unauthenticated Arbitrary Password Change
Published
2026-01-12
Title
User Profile Builder < 3.15.2 - Unauthenticated Arbitrary Password Reset