CVE-2026-54819: WordPress Listdom plugin <= 5.4.0 - SQL Injection vulnerability

Synopsis

SQL injection vulnerability in the Listdom WordPress plugin (versions up to and including 5.4.0) is reachable over the network with no authentication required. An attacker can send crafted HTTP requests to inject arbitrary SQL commands into the underlying database using a blind injection technique, which does not return query results directly but instead infers data through timing or conditional responses. Successful exploitation reads confidential data from the database and can partially disrupt service availability. HarborGuard is tracking this advisory and will make a patched-image rebuild available as soon as an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable plugin endpoint is exposed over the network, meaning an attacker must be able to reach the WordPress installation via HTTP or HTTPS to deliver the malicious payload.

• AuthenticationNot required

  No account or session credential is needed; the injection point is accessible to unauthenticated requests.

• Victim interactionNot required

  The attack is fully server-side and requires no action from any user or administrator of the affected site.

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race conditions, special memory layout, or environmental prerequisites are required beyond network access to the target.

Blast Radius

• An attacker reads arbitrary rows from the WordPress database, including user credentials (hashed passwords), email addresses, session tokens, and any plugin-stored customer or listing records.
• Because the scope is Changed (S:C in the CVSS vector), data exposure can extend beyond the WordPress application boundary to other databases or services sharing the same database server.
• Availability is partially impaired; resource-intensive blind injection queries can degrade database performance and cause intermittent service disruption for legitimate site visitors.