CVE-2026-49063

Vulnerability

The Listdom WordPress plugin versions up to and including 5.5.0 contain an unauthenticated privilege escalation vulnerability. An attacker can exploit this without any prior authentication or user interaction. The exact code path is not publicly detailed, but the flaw is remotely exploitable. [1]

Exploitation

Exploitation requires no authentication or special network position; an attacker can send crafted HTTP requests to the vulnerable plugin endpoints. The reference notes that such vulnerabilities are commonly used in mass-exploit campaigns targeting thousands of sites simultaneously. [1]

Impact

Successful exploitation allows an attacker to escalate privileges to a higher level, potentially gaining administrative access to the WordPress site. This could lead to full site compromise, including data theft, defacement, and further attacks. [1]

Mitigation

The vulnerability is fixed in version 5.6.0 of the Listdom plugin. Users should update immediately. For those unable to update, Patchstack has issued a mitigation rule to block attacks until the patch is applied. No other workarounds are provided. [1]