CVE-2026-104722

Name of the Vulnerable Software and Affected Versions Listdom: AI-powered Business Directory with Classifieds Ads Listings versions prior to 6.1.3

Description Insufficient file path validation in the LSD Menus IX CSV::import() function allows authenticated attackers with administrator-level access and above to delete arbitrary files on the server. This is achieved via the ix[file] parameter. Deleting critical files, such as wp-config.php, can lead to remote code execution.

Recommendations Update to a version newer than 6.1.2. As a temporary workaround, restrict access to the LSD Menus IX CSV::import() function to minimize the risk of exploitation.