{"id":"CVE-2026-104722","revision":"d9f0a4ad44274d4a894d2c7fa3761e4b","records":[{"revision":"d9f0a4ad44274d4a894d2c7fa3761e4b","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-104722","aliases":[],"title":"Listdom: AI-powered Business Directory with Classifieds Ads Listings <= 6.1.2 - Authenticated (Administrator+) Path Traversal to Arbitrary File Deletion via 'ix[file]' Parameter","description":"The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the LSD_Menus_IX_CSV::import function in all versions up to, and including, 6.1.2 This makes it possible for authenticated attackers, with administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).","state":0,"publishedAt":"2026-10-10T08:26:39.464+00:00","modifiedAt":"2026-10-11T16:55:14.975+00:00","affected":[{"ecosystem":"Vendor product","name":"Listdom: AI-powered Business Directory with Classifieds Ads Listings","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"webilia\",\n                    \"product\": \"Listdom: AI-powered Business Directory with Classifieds Ads Listings\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0\",\n                            \"status\": \"affected\",\n                            \"lessThanOrEqual\": \"6.1.2\",\n                            \"versionType\": \"semver\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","score":4.9,"severity":"MEDIUM"}],"references":["https://www.wordfence.com/threat-intel/vulnerabilities/id/4696e474-07b6-4362-afe1-2847e24c08b8?source=cve","https://plugins.trac.wordpress.org/browser/listdom/tags/6.1.2/app/includes/menus/ix/csv.php#L294","https://plugins.trac.wordpress.org/browser/listdom/tags/6.1.2/app/includes/menus/ix/csv.php#L232","https://plugins.trac.wordpress.org/browser/listdom/tags/6.1.2/app/includes/menus/ix/csv.php#L241","https://plugins.trac.wordpress.org/browser/listdom/tags/6.1.2/app/includes/file.php#L25","https://wordpress.org/plugins/listdom/","https://plugins.trac.wordpress.org/changeset/3726849/listdom/trunk/app/includes/menus/ix/csv.php"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-104722","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-104722","identifiers":["CVE-2026-104722"]},"retained":false,"historicalAffected":[]}],"coverage":[]}