External risk intelligence

Listdom Unauthenticated SQL Injection Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-61969

Listdom is a WordPress plugin used to create directory and listing websites. These platforms are designed to be public-facing web applications, making their functionality, including database-driven listing queries, commonly accessible via the public internet.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Listdom, a plugin used for creating directory and listing websites on WordPress. This issue could allow unauthenticated attackers to inject malicious SQL code, potentially leading to unauthorized access or manipulation of data stored within the database. The main concern is to confirm if this specific technology is in use within your organization's digital assets.

Unauthenticated database injection risk exists.
Critical vulnerability impacting public-facing sites.
Confirm Listdom plugin usage and exposure.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker could target public-facing directory websites built with a vulnerable version of Listdom. By sending a specially crafted request to the application, the attacker could manipulate database queries, potentially leading to the unauthorized disclosure of sensitive information from the site's database.

Entry Condition: Publicly accessible web application.
Trigger Point: Unsanitized user input in a Listdom feature.
Resulting Risk: Unauthorized access to sensitive data.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to inject malicious SQL commands into a Listdom instance when supported by the advisory. This could potentially lead to unauthorized access to sensitive data stored within the application's database.

Database content could be affected.
Unauthenticated network access can lead to exposure.
Unauthorized data access may occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

SQL injection in Listdom affects public-facing directory and listing websites. Application owners or platform teams should first identify instances of Listdom, confirm external accessibility and business criticality, and then determine the accountable owner for remediation.

Application owners should own this issue.
Verify external accessibility and business criticality.
Plan remediation based on confirmed risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Listdom plugin?

Listdom is a WordPress plugin designed to help users build and manage directory and listing websites. It provides the core functionality for organizing, displaying, and querying items like business directories or classified listings directly through the WordPress content management system.

What does SQL injection mean for CVE-2026-61969?

This vulnerability falls under the Improper Neutralization of Special Elements used in an SQL Command weakness class (CWE-89). In plain terms, it means the plugin fails to properly filter user-provided data before using it in database queries. This allows an attacker to inject their own malicious database commands, which the system then executes as if they were legitimate instructions.

How is this SQL injection triggered?

The flaw is triggered when an attacker sends a specially crafted request to an application running a vulnerable version of Listdom. The vulnerability does not require any user interaction or prior authentication. It will not be triggered by legitimate site traffic, but rather by deliberate, malicious inputs designed to bypass the plugin's security checks and interact directly with the underlying database.

Is my site at risk according to Halo Surface Signal?

Halo Surface Signal notes that Listdom is primarily used for public-facing directory sites, which are inherently accessible via the internet. Because the software is designed to be reached by the public to view listings, it is likely that your installation is exposed to external network traffic, increasing the relevance of this vulnerability compared to internal-only tools.

What should I do if I run Listdom?

Your first step is to inventory your digital assets to confirm if and where the Listdom plugin is installed. Once you have located all instances, verify their accessibility and business impact. Determine who is responsible for these sites so they can prioritize updating the plugin to a secure version to neutralize the risk of unauthorized database access.

References

patchstack.com/database/wordpress/plugin/listdom/vulnerability/wordp…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.