CVE-2026-104722: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in webilia Listdom: AI-powered Business Directory with Classifieds Ads Listings

CVE-2026-104722 is a path traversal vulnerability (CWE-22) in the Listdom: AI-powered Business Directory with Classifieds Ads Listings WordPress plugin. The issue exists in the LSD_Menus_IX_CSV::import function, which does not properly validate file paths before deletion. Authenticated users with administrator privileges can exploit this to delete arbitrary files on the server. This can escalate to remote code execution if key files like wp-config.php are removed. The vulnerability affects all versions up to and including 6.1.2.

An attacker with administrator-level access can delete arbitrary files on the server, potentially causing denial of service or enabling remote code execution by removing critical files such as wp-config.php. This compromises the confidentiality and integrity of the affected system. The CVSS score of 4.9 reflects a medium severity impact with high confidentiality impact but no integrity or availability impact.

No official patch or fix is currently documented for this vulnerability. Users should monitor the vendor's advisory for updates. Until a fix is available, restrict administrator access to trusted users only and consider additional file system protections to prevent unauthorized file deletions.