CVE-2026-104722 Overview
CVE-2026-104722 affects the Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress. The flaw resides in the LSD_Menus_IX_CSV::import function, which fails to validate file paths before deletion. Authenticated attackers with administrator-level access can delete arbitrary files on the server. Deleting critical files such as wp-config.php can trigger WordPress reinstallation workflows and lead to remote code execution. All plugin versions up to and including 6.1.2 are affected. The issue is categorized as a Path Traversal weakness under [CWE-22].
Critical Impact
Administrator-level attackers can delete arbitrary server files via the plugin's CSV import routine, enabling site takeover through removal of wp-config.php.
Affected Products
- Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress
- All versions up to and including 6.1.2
- WordPress sites with administrator-level accounts exposed to untrusted users
Discovery Timeline
- 2026-10-10 - CVE-2026-104722 published to NVD
- 2026-10-13 - Last updated in NVD database
Technical Details for CVE-2026-104722
Vulnerability Analysis
The Listdom plugin exposes a CSV import workflow handled by the LSD_Menus_IX_CSV::import function. During import processing, the function accepts a file path parameter and later invokes a deletion routine without sanitizing or constraining the supplied path. An authenticated administrator can submit a crafted path that resolves outside the intended upload directory. The underlying file helper, referenced in app/includes/file.php, performs the deletion without validating that the target resides within the plugin's working directory. This mirrors a classic directory traversal pattern where user-controllable path input reaches a filesystem sink.
Root Cause
The root cause is insufficient file path validation inside the CSV import logic located in app/includes/menus/ix/csv.php. The function neither normalizes the path with a canonicalization routine nor enforces a base directory allow-list. Because WordPress plugins typically run with the webserver user's privileges, the deletion extends to any file writable by that account.
Attack Vector
Exploitation requires an authenticated session with administrator privileges. An attacker triggers the CSV import endpoint and supplies a path pointing to a sensitive file such as wp-config.php. Once that configuration file is removed, a subsequent request to the site often launches the WordPress setup flow. The attacker can then reconnect WordPress to an attacker-controlled database and execute arbitrary PHP, achieving remote code execution. The vulnerability is network-reachable but gated by high privileges. See the Wordfence Vulnerability Analysis for additional detail.
Detection Methods for CVE-2026-104722
Indicators of Compromise
- Unexpected deletion or absence of wp-config.php or other core WordPress files
- POST requests to Listdom CSV import endpoints originating from administrator sessions not associated with legitimate operations
- WordPress setup screen (/wp-admin/setup-config.php) appearing on a previously configured site
- New administrator accounts created shortly after a CSV import action
Detection Strategies
- Audit WordPress access logs for admin.php or admin-ajax.php requests referencing Listdom CSV import actions with path parameters containing ../ sequences
- Enable WordPress file integrity monitoring to flag deletions of files under wp-content, wp-includes, and the WordPress root
- Correlate administrator login events with filesystem change events on the webserver
Monitoring Recommendations
- Monitor PHP error logs for require/include failures referencing wp-config.php
- Alert on write and unlink operations initiated by the webserver account outside the uploads directory
- Track changes to WordPress option values, especially siteurl and home, which attackers often modify after takeover
How to Mitigate CVE-2026-104722
Immediate Actions Required
- Update the Listdom plugin to a version later than 6.1.2 once released by the vendor
- Review and reduce the number of accounts with administrator-level privileges
- Rotate WordPress administrator credentials and database credentials stored in wp-config.php
- Back up wp-config.php and other critical files to an off-host location to support rapid recovery
Patch Information
The vendor committed a fix in the plugin repository, visible in the WordPress Listdom Changeset Update. Administrators should install the patched release from the WordPress Listdom Plugin Overview page as soon as it is published.
Workarounds
- Deactivate the Listdom plugin until the patched version is installed
- Restrict administrator access to trusted personnel and enforce multi-factor authentication
- Apply a Web Application Firewall rule that blocks requests to the Listdom CSV import handler containing path traversal sequences
- Set filesystem permissions so that wp-config.php is not writable by the webserver account
# Configuration example: harden wp-config.php against unauthorized deletion
chown root:www-data /var/www/html/wp-config.php
chmod 440 /var/www/html/wp-config.php
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
