CVE-2026-104722: Listdom: AI-powered Business Directory with Classifieds Ads Listings <= 6.1.2 - Authenticated (Administrator+) Path Traversal to Arbitrary File Deletion via 'ix[file]' Parameter
The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the LSDMenusIXCSV::import function in all versions up to, and including, 6.1.2 This makes it possible for authenticated attackers, with administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Affected Software
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker must be authenticated to WordPress with administrator-level privileges or higher. It is therefore primarily relevant where administrator accounts are compromised, shared, or granted to untrusted users.
What does an attacker need to do to exploit it?
The attacker needs to submit a crafted file path through the ix[file] parameter to reach the vulnerable LSD_Menus_IX_CSV::import functionality. The path traversal issue can be used to delete arbitrary server files.
Are default installations affected?
The issue affects Listdom versions through 6.1.2. Exploitation additionally requires an authenticated administrator-level account; the provided information does not identify any configuration prerequisite beyond use of the affected plugin.
What is the impact of successful exploitation?
A successful attacker can delete arbitrary files on the server. Deleting a file such as wp-config.php may enable remote code execution.