Listdom: AI-powered Business Directory with Classifieds Ads Listings <= 6.3.0 - Authenticated (Subscriber+) SQL Injection via 'latitude' and 'longitude' Parameters
- ID
- WPSEC-2026-2278
- Plugin
- Listdom: AI-powered Business Directory with Classifieds Ads Listings (listdom)
- Affected
- all versions before 6.4.0
- Remediation
- Update to 6.4.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
- Weakness
- CWE-89
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-03
- Attack surface
- Listdom: AI-powered Business Directory with Classifieds Ads Listings on WPSec AttackSurface
- Fix released
- Published
Description
The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vulnerable to SQL Injection via the 'latitude' and 'longitude' parameters of the plugin's REST listing endpoints in all versions up to, and including, 6.3.0, due to insufficient escaping of the user-supplied coordinates and lack of sufficient preparation of the INSERT and UPDATE queries on the lsd_data table. The values were only passed through sanitize_text_field() and then concatenated into the queries. The listing create endpoint performs no capability check beyond a valid Listdom user token, but it also requires one of the site's Listdom REST API tokens. This makes it possible for authenticated attackers, with subscriber-level access and above, who have the site's Listdom API token (for example from a client application that uses it) to append additional SQL queries to existing queries, which can be used to extract sensitive information from the database.
References
- https://wpsec.com/vuln/WPSEC-2026-2278/
- https://plugins.svn.wordpress.org/listdom/tags/6.4.0/
- https://wordpress.org/plugins/listdom/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS