CVE-2026-49063: WordPress Listdom plugin <= 5.5.0 - Privilege Escalation vulnerability

Synopsis

An unauthenticated privilege escalation vulnerability affects the Listdom WordPress plugin at version 5.5.0 and earlier, published by Webilia Inc. The flaw is reachable over the network with no authentication required and no user interaction needed, making it trivially accessible to any attacker who can reach the WordPress installation. Successful exploitation allows an attacker to elevate their privileges within the application, gaining unauthorized read, write, and limited availability impact on the target. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment a fix version is published upstream.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the WordPress installation over the network; the vulnerable endpoint is exposed via standard HTTP/HTTPS with no network-layer restriction implied by the CVSS vector.

• AuthenticationNot required

  No account or session credentials of any privilege level are needed to trigger the vulnerability.

• Victim interactionNot required

  The attacker can exploit this vulnerability without any action from an existing user or administrator.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special timing, race conditions, or environmental prerequisites beyond network access.

Blast Radius

• A successful attacker gains elevated privileges within the WordPress application, potentially accessing functionality and data restricted to higher-privilege roles.
• Confidential data accessible to elevated roles, such as user records, private posts, and plugin configuration, becomes readable by the attacker.
• The attacker can modify application content, settings, or user data within the scope of the escalated role.
• Limited availability impact is possible, with the attacker able to disrupt or degrade portions of the application reachable at the escalated privilege level.